XML External Entity Processing Vulnerability in Apache NiFi by The Apache Software Foundation
CVE-2020-13940

5.5MEDIUM

Key Information:

Vendor
Apache
Status
Apache Nifi
Vendor
CVE Published:
1 October 2020

Summary

In Apache NiFi versions 1.0.0 to 1.11.4, a configuration flaw in the notification service manager and various policy authorizers permitted trusted administrators to configure XML files that could make external calls to potentially malicious services. This vulnerability arises from improper handling of user-supplied XML data, which can lead to unauthorized access and data exposure.

Affected Version(s)

Apache NiFi Apache NiFi 1.0.0 to 1.11.4

References

https://nifi.apache.org/security#CVE-2020-13940
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.