BIT-nifi-2021-44145

vendorUSosv

Apache NiFi information disclosure by XXE

view advisory published 2025-09-12Licence: per source

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-44145US	medium6.5	1.76% (78th)	—	2021-12-17
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sens…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2021/12/17/1ADVISORY
https://nifi.apache.org/security.html#1.15.1-vulnerabilitiesADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-44145WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan