Improper Restriction of XML External Entity Reference in Apache NiFi
Date: 2022-01
Affected: maven/org.apache.nifi:nifi
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2020-13940
CWE: CWE-611
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).


Mitigations:

Architectural layers (MAESTRO):