{"vulnerability": "cve-2023-41180", "sightings": [{"uuid": "8eef420a-0b25-4c09-9160-766970624cf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-41180", "type": "seen", "source": "https://t.me/arpsyndicate/2348", "content": "#ExploitObserverAlert\n\nCVE-2023-41180\n\nDESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-41180. Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped,  disabling verification by default, when using HTTPS.  Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.\n\nFIRST-EPSS: 0.000440000\nNVD-IS: 3.6\nNVD-ES: 2.2", "creation_timestamp": "2024-01-03T19:34:39.000000Z"}, {"uuid": "9266ec3b-f031-4fe0-955f-f9b2935cc256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-41180", "type": "seen", "source": "https://t.me/cibsecurity/69710", "content": "\u203c CVE-2023-41180 \u203c\n\nIncorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS.Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-03T20:15:34.000000Z"}]}