CVE-2017-12623
XML External Entity Reference in Apache NiFi
6.5
MEDIUM
CVSS 3.1
EPSS 0.30%
Description
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
How to fix CVE-2017-12623
To remediate CVE-2017-12623, upgrade the affected package to a fixed version below.
- —upgrade to 1.4.0 or later
Is CVE-2017-12623 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 1.0.0, < 1.4.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |