Vulnerability · Published Feb 10, 2023 · Assigned by apache

CVE-2023-22832Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes

High 7.5

In plain English

A high-severity XML external entity in Apache NiFi from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.4%top 27.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.nifi:nifi-ccda-processors	1.20.0	GHSA-hxjp-q6c3-38fx

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache NiFi	1.2.0 – through 1.19.1

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://nifi.apache.org/security.html#CVE-2023-22832 technical-description
https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w vendor-advisory