Improper Restriction of XML External Entity Reference in Apache NiFi

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-13940 · ADVISORY
• apache/nifi commit 7f0416e · WEB
• nifi.apache.org/security · WEB

org.apache.nifi:nifi のその他の脆弱性

• CVE-2022-33140高 8.8The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments f…
• CVE-2022-29265高 7.5Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard…
• CVE-2021-44145中 6.5In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included maliciou…
• CVE-2020-9491高 7.5In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by pr…
• CVE-2020-9487高 7.5In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a req…