CVE-2023-22832CWE-611

Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes

High · published February 10, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references.

Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references.

The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01410 · 72.4th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2023-02-10T07:45Z
EPSS history
Timeline
  • 10 FEB 07:45Z
    Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes
    cvelistv5