CVE-2017-12623: XEE
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12623?
CVE-2017-12623 is categorized as a high severity vulnerability due to its potential to allow unauthorized file access through an XML External Entity attack.
How do I fix CVE-2017-12623?
To fix CVE-2017-12623, users must upgrade their Apache NiFi installation to version 1.4.0 or later.
What types of attacks are possible with CVE-2017-12623?
CVE-2017-12623 allows for XML External Entity (XXE) attacks, which can be exploited by uploading malicious templates.
Which versions of Apache NiFi are affected by CVE-2017-12623?
CVE-2017-12623 affects Apache NiFi versions 1.0.0 through 1.3.0.
Is CVE-2017-12623 still a concern for users running newer versions of Apache NiFi?
No, CVE-2017-12623 is not a concern for users running Apache NiFi version 1.4.0 or newer, as it contains the necessary security fixes.