-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Apache NiFi's use of a pre-5.15.3 ActiveMQ client (CVE-2015-5254), which allows unsafe deserialization via JMS ObjectMessage. The NiFi JMS processors (ConsumeJMS/PublishJMS) are the entry points for processing messages. The ConsumeJMS.onTrigger method drives message consumption, invoking ActiveMQ's deserialization routines. The JMSConsumer.consume method directly interacts with the JMS client to retrieve messages. During exploitation, these functions would appear in runtime profiles when processing malicious JMS content. The patch upgraded the library, implying these functions were the execution path for the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.nifi:nifi | maven | < 1.6.0 | 1.6.0 |