Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

MEDIO 6.5CVE-2021-44145 · BIT-nifi-2021-44145 · GHSA-rq96-qhc5-vm4r · Published 17/12/2021 · updated 17/06/2026

En resumen

CVE-2021-44145 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a org.apache.nifi:nifi, nifi (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.8%, mayor que el 78.0% de las vulnerabilidades.
Solución: actualizar a 1.15.1 o posterior.

Package	Affected versions	Patched versions
org.apache.nifi:nifi Maven	`< 1.15.1`	`1.15.1`
nifi apache	`≥ 0.1.0, < 1.15.1`	`1.15.1`

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

NVD description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

References

nvd.nist.gov/vuln/detail/CVE-2021-44145 · ADVISORY
nifi.apache.org/security.html · WEB
openwall.com/lists/oss-security/2021/12/17/1 · WEB

Más vulnerabilidades de org.apache.nifi:nifi

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.nifi:nifi

Maven

< 1.15.1

1.15.1

nifi

apache

≥ 0.1.0, < 1.15.1

1.15.1

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

NVD description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

Más vulnerabilidades de org.apache.nifi:nifi

Ver todo →