CVE-2017-15703

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

• CWE-502

• https://nifi.apache.org/security.html#CVE-2017-15703Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2017-15703Vendor Advisory

Published

Jan 25, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15698When parsing the AIA-Extension field of a client certificate…
• CVE-2017-15699A Denial of Service vulnerability was found in Apache Qpid D…6.5
• CVE-2017-1570IBM Jazz Foundation products could allow an authenticated us…
• CVE-2017-15700A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirect…
• CVE-2017-15701In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclus…7.5
• CVE-2017-15702In Apache Qpid Broker-J 0.18 through 0.32, if the broker is …9.8
• CVE-2017-15704Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-15705A denial of service vulnerability was identified that exists…
• CVE-2017-15706As part of the fix for bug 61201, the documentation for Apac…
• CVE-2017-15707In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an …
• CVE-2017-15708In Apache Synapse, by default no authentication is required …9.8
• CVE-2017-15709When using the OpenWire protocol in ActiveMQ versions 5.14.0…