CVE-2017-12623

CWE-611 — XML External Entity (XXE)5 documents5 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 46.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache NifiApache Nifi
Timeline
PublishedOct 10
Latest updateMay 17

Description

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.apache.nifi:nifi1.0.0 — 1.4.0
▶NVDapache/nifi7 versions+6
▶CVEListV5apache_software_foundation/apache_nifi1.0.0 to 1.3.0

🔴Vulnerability Details

3
OSV
XML External Entity Reference in Apache NiFi↗2022-05-17
▶
GHSA
XML External Entity Reference in Apache NiFi↗2022-05-17
▶
CVEList
CVE-2017-12623: An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack↗2017-10-10
▶

📋Vendor Advisories

1
Apache
Apache nifi: CVE-2017-12623↗
▶
CVE-2017-12623 (MEDIUM CVSS 6.5) | An authorized user could upload a t | cvebase.io