CVE-2021-44145
Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi
6.5
MEDIUM
CVSS 3.1
EPSS 0.32%
Description
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
How to fix CVE-2021-44145
To remediate CVE-2021-44145, upgrade the affected package to a fixed version below.
- Bitnami/nifi—upgrade to 1.15.1 or later
- —upgrade to 1.15.1 or later
Is CVE-2021-44145 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- >= 0.1.0, < 1.15.1
- from 0, < 1.15.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |