GitHub Advisoryadvisory · Maven

GHSA-hxjp-q6c3-38fx XML External Entity Reference in Apache NiFi

HIGH Published 2023-02-10 Modified 2024-10-14 Official page ↗
Aliases
CVE-2023-22832
Ecosystem
Maven
Packages
org.apache.nifi:nifi-ccda-processors
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2023-02-10

Affected packages

• Maven org.apache.nifi:nifi-ccda-processors: >= 1.2.0, < 1.20.0 → fixed in 1.20.0

Description

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

Related

Alias · CVE (1)

  • CVE-2023-22832 The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References