CVEvulnerability

CVE-2017-12623

6.5 MEDIUM Published 2017-10-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-611

Description

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Affected configurations

• apache nifi 1.0.0 • apache nifi 1.0.1 • apache nifi 1.1.0 • apache nifi 1.1.1 • apache nifi 1.1.2 • apache nifi 1.2.0 • apache nifi 1.3.0

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References