Vulnerability Details : CVE-2023-41180
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS.
Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.
Products affected by CVE-2023-41180
- cpe:2.3:a:apache:nifi_minifi_c\+\+:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-41180
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 35 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-41180
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2023-41180
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: security@apache.org (Primary)
References for CVE-2023-41180
-
https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y
Apache Mail ArchivesIssue Tracking;Mailing List;Vendor Advisory
Jump to