CVE-2019-10080
Medium
Description
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Apache Nifi
PublishedNov 19, 2019
First seenNov 19, 2019
How to fix
Update
- org.apache.nifi:nifi-security1.10.0 or later
- org.apache.nifi:nifi1.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache nifi | 1.3.0 ≤ v ≤ 1.9.2 | — |
| org.apache.nifi:nifi-securityMaven | 1.3.0 ≤ v < 1.10.0 | 1.10.0 |
| org.apache.nifi:nifiMaven | 1.3.0 ≤ v < 1.10.0 | 1.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.