GitHub Advisoryadvisory · Maven

GHSA-qj7f-j6h9-g5rq XML External Entity Reference in Apache NiFi

MEDIUM Published 2022-05-17 Modified 2022-11-01 Official page ↗
Aliases
CVE-2017-12623
Ecosystem
Maven
Packages
org.apache.nifi:nifi
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2022-11-01

Affected packages

• Maven org.apache.nifi:nifi: >= 1.0.0, < 1.4.0 → fixed in 1.4.0

Description

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Related

Alias · CVE (1)

  • CVE-2017-12623 An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE)… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References