CVE-2021-44145: Apache NiFi information disclosure by XXE
Published Dec 17, 2021
·Updated
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
Affected Software
1 affected component
Apache nifi>=0.1.0<1.15.1
Event History
Dec 17, 2021
CVE Published
via MITRE·08:50 AM
Data Sourced
via MITRE·08:50 AM
DescriptionWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2021-44145?
CVE-2021-44145 is a vulnerability in the TransformXML processor of Apache NiFi before version 1.15.1.
2
What is the severity of CVE-2021-44145?
The severity of CVE-2021-44145 is medium, with a CVSS score of 6.5.
3
How can an authenticated user exploit CVE-2021-44145?
An authenticated user could configure an XSLT file in the TransformXML processor, which, if it included malicious external entity calls, may reveal sensitive information.
4
Which version of Apache NiFi is affected by CVE-2021-44145?
CVE-2021-44145 affects Apache NiFi versions before 1.15.1.
5
How can I mitigate the vulnerability in Apache NiFi?
To mitigate the vulnerability, update Apache NiFi to version 1.15.1 or later.