CVE-2017-7667: Origin Validation Error in Apache NiFi
Summary
CVE-2017-7667: Origin Validation Error in Apache NiFi. Affects org.apache.nifi:nifi across 2 version ranges.
< 0.7.4
>= 1.0.0, < 1.3.0
Fixed in 0.7.4 or 1.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration and dataflow automation tool. It allows users to collect, process, and distribute data from various sources. The vulnerability identified as CVE-2017-7667 affects Apache NiFi versions before 0.7.4 and 1.x before 1.3.0. This vulnerability arises from the failure to establish the necessary response header that informs browsers to only allow framing with the same origin.
Vulnerability Detail
The origin validation error in Apache NiFi can lead to security issues. Without the proper response header, browsers may allow framing from different origins, which can enable clickjacking attacks and other cross-origin vulnerabilities. This vulnerability has a CVSSv3 score of 7.5, indicating a high severity level. It is important to address this vulnerability to prevent unauthorized access and potential data breaches.
How To Fix
Latest published version: 2.12.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.7.40.7.4 -
>= 1.0.0, < 1.3.01.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to manually configure the response header in the Apache NiFi configuration. This can be done by modifying the relevant configuration file to include the appropriate header directive. Here is an example of how to add the header in the nifi.properties file:
nifi.web.http.response.header.frame-options=SAMEORIGIN
Please note that this workaround is not a permanent solution and should be followed by upgrading to the fixed versions as soon as possible.
Conclusion
The origin validation error in Apache NiFi (CVE-2017-7667) poses a high security risk due to the potential for clickjacking attacks and other cross-origin vulnerabilities. It is crucial to upgrade to the fixed versions or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi →
FAQ
Apache NiFi is an open-source data integration and dataflow automation tool. It allows users to collect, process, and distribute data from various sources.
This vulnerability can enable clickjacking attacks and other cross-origin vulnerabilities, potentially leading to unauthorized access and data breaches.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade Apache NiFi to version 0.7.4 or later for versions before 1.0.0, and version 1.3.0 or later for versions between 1.0.0 and 1.x.
Yes, a temporary workaround is to manually configure the response header in the Apache NiFi configuration. However, this should be followed by upgrading to the fixed versions as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi.
