CVE-2018-17193

The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

• CWE-79

• https://nifi.apache.org/security.html#CVE-2018-17193Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2018-17193Vendor Advisory

Published

Dec 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17188Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-…
• CVE-2018-17189In Apache HTTP server versions 2.4.37 and prior, by sending …5.3
• CVE-2018-1719IBM WebSphere Application Server 8.5 and 9.0 could provide w…5.9
• CVE-2018-17190In all versions of Apache Spark, its standalone resource man…
• CVE-2018-17191Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configu…
• CVE-2018-17192The X-Frame-Options headers were applied inconsistently on s…
• CVE-2018-17194When a client request to a cluster node was replicated to ot…
• CVE-2018-17195The template upload API endpoint accepted requests from diff…
• CVE-2018-17196In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is p…
• CVE-2018-17197A carefully crafted or corrupt sqlite file can cause an infi…
• CVE-2018-17198Server-side Request Forgery (SSRF) and File Enumeration vuln…
• CVE-2018-17199In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_sess…