Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

MOYENNE 6.5CVE-2021-44145 · BIT-nifi-2021-44145 · GHSA-rq96-qhc5-vm4r · Published 17/12/2021 · updated 17/06/2026

En bref

CVE-2021-44145 est une vulnérabilité MOYENNE (CVSS 6.5) touchant org.apache.nifi:nifi, nifi (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.8%, plus élevée que 78.0% des vulnérabilités.
Correctif : mettre à jour vers 1.15.1 ou plus récent.

Package	Affected versions	Patched versions
org.apache.nifi:nifi Maven	`< 1.15.1`	`1.15.1`
nifi apache	`≥ 0.1.0, < 1.15.1`	`1.15.1`

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

NVD description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

References

nvd.nist.gov/vuln/detail/CVE-2021-44145 · ADVISORY
nifi.apache.org/security.html · WEB
openwall.com/lists/oss-security/2021/12/17/1 · WEB

Autres vulnérabilités de org.apache.nifi:nifi

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.nifi:nifi

Maven

< 1.15.1

1.15.1

nifi

apache

≥ 0.1.0, < 1.15.1

1.15.1

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

NVD description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

Autres vulnérabilités de org.apache.nifi:nifi

Tout voir →