Vulnerability · Published Apr 30, 2022 · Assigned by apache
CVE-2022-29265Improper Restriction of XML External Entity References in Multiple Components
High 7.5
In plain English
A high-severity XML external entity in Apache NiFi from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.nifi:nifi | 1.16.1 | GHSA-wc97-7623-rxwx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache NiFi | 0.0.1 to 1.16.0 – through 0.0.1 to 1.16.0 |
Weakness: CWE-611
References
- https://nifi.apache.org/security.html#CVE-2022-29265 x_refsource_MISC
- https://lists.apache.org/thread/47od9kr9n4cyv0mv81jh3pkyx815kyjl x_refsource_MISC