Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes

CVE-2023-22832

What is CVE-2023-22832?

The ExtractCCDAAttributes Processor in Apache NiFi versions 1.2.0 to 1.19.1 is susceptible to vulnerabilities due to its inability to restrict XML External Entity references. This flaw allows attackers to exploit flow configurations that utilize the processor by injecting malicious XML documents with Document Type Declarations containing XML External Entity references. To mitigate this risk, Apache has provided a resolution that disables Document Type Declarations and prohibits XML External Entity resolution within the processor, thereby enhancing security.

References