GHSA-rq96-qhc5-vm4r

ghsaUSosv

Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

view advisory published 2022-01-05Licence: CC-BY-4.0

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-44145US	medium6.5	1.76% (78th)	—	2021-12-17
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sens…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2021/12/17/1WEB
https://nifi.apache.org/security.html#1.15.1-vulnerabilitiesWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-44145ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan