Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes
CVE-2023-22832

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Nifi
Vendor
CVE Published:
10 February 2023

What is CVE-2023-22832?

The ExtractCCDAAttributes Processor in Apache NiFi versions 1.2.0 to 1.19.1 is susceptible to vulnerabilities due to its inability to restrict XML External Entity references. This flaw allows attackers to exploit flow configurations that utilize the processor by injecting malicious XML documents with Document Type Declarations containing XML External Entity references. To mitigate this risk, Apache has provided a resolution that disables Document Type Declarations and prohibits XML External Entity resolution within the processor, thereby enhancing security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache NiFi 1.2.0 <= 1.19.1

References

https://nifi.apache.org/security.html#CVE-2023-22832
technical-description
https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yi Cai of Chaitin Tech
JSON
.