CVE-2017-15697

A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

• CWE-20

• https://nifi.apache.org/security.html#CVE-2017-15697Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2017-15697Vendor Advisory

Published

Jan 23, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15691In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prio…
• CVE-2017-15692In Apache Geode before v1.4.0, the TcpServer within the Geod…
• CVE-2017-15693In Apache Geode before v1.4.0, the Geode server stores appli…
• CVE-2017-15694When an Apache Geode server versions 1.0.0 to 1.8.0 is opera…
• CVE-2017-15695When an Apache Geode server versions 1.0.0 to 1.4.0 is confi…
• CVE-2017-15696When an Apache Geode cluster before v1.4.0 is operating in s…
• CVE-2017-15698When parsing the AIA-Extension field of a client certificate…
• CVE-2017-15699A Denial of Service vulnerability was found in Apache Qpid D…6.5
• CVE-2017-1570IBM Jazz Foundation products could allow an authenticated us…
• CVE-2017-15700A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirect…
• CVE-2017-15701In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclus…7.5
• CVE-2017-15702In Apache Qpid Broker-J 0.18 through 0.32, if the broker is …9.8