Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes
CVE-2023-22832

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache NiFi
Vendor
CVE Published:
10 February 2023

Summary

The ExtractCCDAAttributes Processor in Apache NiFi versions 1.2.0 to 1.19.1 is susceptible to vulnerabilities due to its inability to restrict XML External Entity references. This flaw allows attackers to exploit flow configurations that utilize the processor by injecting malicious XML documents with Document Type Declarations containing XML External Entity references. To mitigate this risk, Apache has provided a resolution that disables Document Type Declarations and prohibits XML External Entity resolution within the processor, thereby enhancing security.

Affected Version(s)

Apache NiFi 1.2.0 <= 1.19.1

References

https://nifi.apache.org/security.html#CVE-2023-22832
technical-description
https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yi Cai of Chaitin Tech
.