CVE-2023-41180
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotiation. The Disable Peer Verification property was effectively flipped, disabling verification by default when using HTTPS.
Risk Assessment
The organization is exposed to man-in-the-middle attacks, which could lead to data interception or the introduction of malicious software.
Recommendation
It is recommended to set the Disable Peer Verification property to true in InvokeHTTP or upgrade to MiNiFi C++ version 0.15.0 to correct the default behavior.
Original NVD description (English source)
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS. Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.