CVE-2018-1309

CWE-611 — XML External Entity (XXE)6 documents5 sources
Severity
9.8CRITICAL
EPSS
3.7%
top 12.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache NifiApache Software Foundation Apache Nifi
Timeline
PublishedMay 23
Latest updateMay 14

Description

Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/nifi< 1.6.0

Patches

Patch: nifi.apache.org ↗Patch: nifi.apache.org ↗

🔴Vulnerability Details

4
GHSA
Improper Restriction of XML External Entity Reference in Apache NiFi↗2022-05-14
▶
OSV
Improper Restriction of XML External Entity Reference in Apache NiFi↗2022-05-14
▶
OSV
linux-aws vulnerabilities↗2019-09-02
▶
CVEList
CVE-2018-1309: Apache NiFi External XML Entity issue in SplitXML processor↗2018-05-23
▶

📋Vendor Advisories

1
Apache
Apache nifi: CVE-2018-1309↗
▶