Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xajdmLWo2aDktZzVycc4AAYQI

XML External Entity Reference in Apache NiFi

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Permalink: https://github.com/advisories/GHSA-qj7f-j6h9-g5rq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xajdmLWo2aDktZzVycc4AAYQI
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: 8 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-qj7f-j6h9-g5rq, CVE-2017-12623
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-12623
• https://nifi.apache.org/security.html#CVE-2017-12623
• https://github.com/advisories/GHSA-qj7f-j6h9-g5rq

Affected Packages