Improper Restriction of XML External Entity Reference in Apache NiFi

2022-01-0620:41:00

Google

osv.dev

0.0004 Low

EPSS

Percentile

12.7%

JSON

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

CPENameOperatorVersion
org.apache.nifi:nifieq1.9.1
org.apache.nifi:nifieq1.11.2
org.apache.nifi:nifieq1.0.0
org.apache.nifi:nifieq1.11.1
org.apache.nifi:nifieq1.1.1
org.apache.nifi:nifieq1.8.0
org.apache.nifi:nifieq1.1.0
org.apache.nifi:nifieq1.2.0
org.apache.nifi:nifieq1.6.0
org.apache.nifi:nifieq1.10.0

Name	Operator	Version
org.apache.nifi:nifi	eq	1.9.1
org.apache.nifi:nifi	eq	1.11.2
org.apache.nifi:nifi	eq	1.0.0
org.apache.nifi:nifi	eq	1.11.1
org.apache.nifi:nifi	eq	1.1.1
org.apache.nifi:nifi	eq	1.8.0
org.apache.nifi:nifi	eq	1.1.0
org.apache.nifi:nifi	eq	1.2.0
org.apache.nifi:nifi	eq	1.6.0
org.apache.nifi:nifi	eq	1.10.0