GitHub Advisoryadvisory · Maven

GHSA-rq96-qhc5-vm4r Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

MEDIUM Published 2022-01-05 Modified 2022-01-04 Official page ↗
Aliases
CVE-2021-44145
Ecosystem
Maven
Packages
org.apache.nifi:nifi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-01-04

Affected packages

• Maven org.apache.nifi:nifi: < 1.15.1 → fixed in 1.15.1

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

Related

Alias · CVE (1)

  • CVE-2021-44145 In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References