CVE-2019-10080

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file

published November 19, 2019

CVSS
—
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02258 · 82.8th percentile
Published
2019-11-19T21:32Z
EPSS history
Timeline
  • 19 NOV 21:32Z
    The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file
    cvelistv5