Back to Vulnerability Directory
CRITICALFixed upstream
CVE-2018-1309
Apache NiFi External XML Entity issue in SplitXML processor.
Technology
Apache NiFi
CVSS Score
9.8 / 10.0
Affected Versions
<1.6.0
Upstream Fix
See upstream advisory
Published
May 23, 2018
OSSeva Coverage
Fixed upstream
Description
Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Is your Apache NiFi deployment affected?
If you're running <1.6.0, you need this patch. Book a discovery call to get covered.