PT-2017-12607 · Apache · Apache Nifi

Mike Cole + 1 · Published 2017-10-10 · Updated 2022-05-17 · CVE-2017-12623

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.4.0

Description The issue allows an authorized user to upload a template containing malicious code, which can then access sensitive files via an XML External Entity (XXE) attack. This occurs due to improper handling of XML External Entities.

Recommendations For Apache NiFi versions prior to 1.4.0, upgrade to Apache NiFi 1.4.0 or a later version to properly handle XML External Entities and prevent XXE attacks.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-12623

GHSA-QJ7F-J6H9-G5RQ

Affected Products

Apache Nifi

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12623 · Security Note
• https://nifi.apache.org/security.html#CVE-2017-12623 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12623 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qj7f-j6h9-g5rq · Vendor Advisory