CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack

published October 10, 2017

CVSS
—
EPSS
2%
Percentile
80.0
In the wild
Unconfirmed
What it is

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01940 · 80.0th percentile
Published
2017-10-10T18:00Z
EPSS history
Timeline
  • 10 OCT 18:00Z
    An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack
    cvelistv5