PT-2018-11592 · Apache · Apache Nifi

Åç Ǭ · Publicado 2018-05-23 · Atualizado 2022-05-14 · CVE-2018-1309

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.6.0

Description The issue concerns an External XML Entity problem in the SplitXML processor, which could lead to information disclosure or remote code execution if malicious XML content is used.

Recommendations For versions prior to 1.6.0, upgrade to Apache NiFi 1.6.0 or a later version to apply the fix that disables external general entity parsing and disallows doctype declarations.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-1309

GHSA-42WX-65G4-5CXV

Produtos afetados

Apache Nifi

Referências · 7

• https://github.com/apache/nifi · Nota
• https://github.com/apache/nifi/commit/28067a29fd13cdf8e21b440fc65c6dd67872522f · Nota
• https://osv.dev/vulnerability/GHSA-42wx-65g4-5cxv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1309 · Nota de Segurança
• https://issues.apache.org/jira/browse/NIFI-4869 · Nota
• https://nifi.apache.org/security.html#CVE-2018-1309 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1309 · Aviso do Fabricante