CVE-2023-22832

CWE-611 — XML External Entity (XXE)5 documents5 sources
Severity
7.5HIGH
EPSS
2.0%
top 16.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache NifiApache Nifi
Timeline
PublishedFeb 10

Description

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.apache.nifi:nifi-ccda-processors1.2.0 — 1.20.0
▶NVDapache/nifi1.2.0 — 1.19.1
▶CVEListV5apache_software_foundation/apache_nifi1.2.0 — 1.19.1

🔴Vulnerability Details

3
CVEList
Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes↗2023-02-10
▶
GHSA
XML External Entity Reference in Apache NiFi↗2023-02-10
▶
OSV
XML External Entity Reference in Apache NiFi↗2023-02-10
▶

📋Vendor Advisories

1
Apache
Apache nifi: CVE-2023-22832↗
▶