CVE-2020-13940

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators…

published October 1, 2020

CVSS
—
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01911 · 79.7th percentile
Published
2020-10-01T19:55Z
EPSS history
Timeline
  • 01 OCT 19:55Z
    In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators…
    cvelistv5