CVE-2018-1309
Critical
Description
Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Nifi
PublishedMay 23, 2018
First seenMay 23, 2018
How to fix
Update
- apache nifi1.6.0 or later
- org.apache.nifi:nifi-standard-processors1.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache nifi | v < 1.6.0 | 1.6.0 |
| org.apache.nifi:nifi-standard-processorsMaven | 0.1.0 ≤ v < 1.6.0 | 1.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.