CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Score

CVSS 3.0 6.5 Medium

Status

Modified - security@apache.org

Published

2017-10-10

Last modified

2024-09-16

Weaknesses

CWE-611

Affected products

• Nifi (Apache)
• Apache Nifi (Apache Software Foundation)

References

• https://nifi.apache.org/security.html#CVE-2017-12623