Lucene search
ApacheCVELIST:CVE-2023-41180HistorySep 03, 2023 - 3:52 p.m.
CVE-2023-41180 Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++
2023-09-0315:52:52
CWE-295
apache
www.cve.org
apache nifi
minifi c++
certificate validation
0.0004 Low
EPSS
Percentile
10.3%
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS.
Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Apache NiFi MiNiFi C++",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.14.0",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
}
]Related
osv
osv
CVE-2023-41180
2023-09-03 16:15:10
cve
cve
CVE-2023-41180
2023-09-03 16:15:10
nvd
nvd
CVE-2023-41180
2023-09-03 16:15:10
prion
prion
Default credentials
2023-09-03 16:15:00