PT-2018-11592 · Apache · Apache Nifi

Åç Ǭ · Published 2018-05-23 · Updated 2022-05-14 · CVE-2018-1309

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.6.0

Description The issue concerns an External XML Entity problem in the SplitXML processor, which could lead to information disclosure or remote code execution if malicious XML content is used.

Recommendations For versions prior to 1.6.0, upgrade to Apache NiFi 1.6.0 or a later version to apply the fix that disables external general entity parsing and disallows doctype declarations.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-1309

GHSA-42WX-65G4-5CXV

Affected Products

Apache Nifi

References · 7

• https://osv.dev/vulnerability/GHSA-42wx-65g4-5cxv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1309 · Security Note
• https://nifi.apache.org/security.html#CVE-2018-1309 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1309 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/28067a29fd13cdf8e21b440fc65c6dd67872522f · Note
• https://issues.apache.org/jira/browse/NIFI-4869 · Note