-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing X-Frame-Options headers in HTTP responses. In Java web applications, security headers like X-Frame-Options are typically implemented in servlet filters that process all responses. The SecurityFilter class in NiFi's web security configuration is the logical location for this mitigation. The absence of header-setting code in this filter's doFilter method in vulnerable versions would allow the framing vulnerability. The patched versions would add response.addHeader("X-Frame-Options", "SAMEORIGIN") in this filter, making the pre-patch version of this method the vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.nifi:nifi | maven | < 0.7.4 | 0.7.4 |
| org.apache.nifi:nifi | maven | >= 1.0.0, < 1.3.0 | 1.3.0 |