Vulnerability · Published Sep 3, 2023 · Assigned by apache

CVE-2023-41180Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++

Medium 5.9

In plain English

A medium-severity improper certificate validation in Apache NiFi MiNiFi C++ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS NVD)5.9Medium

Exploit odds (30 days)0.6%top 51.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS. Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache NiFi MiNiFi C++	0.13.0 – through 0.14.0

Weakness: CWE-295

References

https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y vendor-advisory