CVE-2023-22832: XEE
First published: Fri Feb 10 2023(Updated: )
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache NiFi | >=1.2.0<=1.19.1 | |
| maven/org.apache.nifi:nifi-ccda-processors | >=1.2.0<1.20.0 | 1.20.0 |
| >=1.2.0<=1.19.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w
- https://nifi.apache.org/security.html#CVE-2023-22832
- https://nvd.nist.gov/vuln/detail/CVE-2023-22832
- https://github.com/apache/nifi/commit/e966336e8966cf0cbbd12a2c4f2d73a7ceb75cd8
- https://github.com/advisories/GHSA-hxjp-q6c3-38fx (Advisory)
Frequently Asked Questions
What is CVE-2023-22832?
CVE-2023-22832 is a vulnerability in Apache NiFi 1.2.0 through 1.19.1 that allows malicious XML documents to exploit XML External Entity references in the ExtractCCDAAttributes Processor.
How severe is CVE-2023-22832?
CVE-2023-22832 has a severity rating of 7.5, which is considered high.
How does CVE-2023-22832 impact Apache NiFi?
CVE-2023-22832 impacts Apache NiFi by potentially allowing malicious XML documents to exploit XML External Entity references in the ExtractCCDAAttributes Processor, leading to potential security breaches.
How can I fix CVE-2023-22832 in Apache NiFi?
To fix CVE-2023-22832 in Apache NiFi, you should update your installation to a version that is not affected, specifically a version higher than 1.19.1.
Where can I find more information about CVE-2023-22832?
You can find more information about CVE-2023-22832 on the Apache NiFi security page and the Apache mailing list.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-hxjp-q6c3-38fx
- alias/CVE-2023-22832
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/softwarecombine
- agent/author
- agent/event
- agent/description
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/apache
- canonical/apache nifi
- version/apache nifi/1.2.0
- version/apache nifi/1.19.1
- package-manager/maven