GitHub Advisoryadvisory · Maven

GHSA-744r-vv2g-2x6g Apache NiFi information disclosure by XXE

MEDIUM Published 2019-12-02 Modified 2021-06-15 Official page ↗
Aliases
CVE-2019-10080
Ecosystem
Maven
Packages
org.apache.nifi:nifi-security, org.apache.nifi:nifi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2019-12-02

Affected packages

• Maven org.apache.nifi:nifi-security: >= 1.3.0, < 1.10.0 → fixed in 1.10.0 • Maven org.apache.nifi:nifi: >= 1.3.0, < 1.10.0 → fixed in 1.10.0

Description

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

Related

Alias · CVE (1)

  • CVE-2019-10080 The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References