diff --git a/advisories/github-reviewed/2018/12/GHSA-4qq9-rrq6-48ff/GHSA-4qq9-rrq6-48ff.json b/advisories/github-reviewed/2018/12/GHSA-4qq9-rrq6-48ff/GHSA-4qq9-rrq6-48ff.json index 70eb487b72d..fd1ef47cf60 100644 --- a/advisories/github-reviewed/2018/12/GHSA-4qq9-rrq6-48ff/GHSA-4qq9-rrq6-48ff.json +++ b/advisories/github-reviewed/2018/12/GHSA-4qq9-rrq6-48ff/GHSA-4qq9-rrq6-48ff.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4qq9-rrq6-48ff", - "modified": "2021-09-01T18:01:38Z", + "modified": "2024-03-04T21:35:23Z", "published": "2018-12-20T22:02:39Z", "aliases": [ "CVE-2018-17193" ], - "summary": "Moderate severity vulnerability that affects org.apache.nifi:nifi", + "summary": "Cross site scripting in org.apache.nifi:nifi", "details": "The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.", "severity": [ { @@ -43,10 +43,22 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17193" }, + { + "type": "WEB", + "url": "https://github.com/apache/nifi/commit/e62aa0252dfcf34dff0c3a9c51265b1d0f9dfc9f" + }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-4qq9-rrq6-48ff" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/nifi" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/NIFI-5442" + }, { "type": "WEB", "url": "https://nifi.apache.org/security.html#CVE-2018-17193"