Vulnerabilities > CVE-2019-10080 - XXE vulnerability in Apache Nifi

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
apache
CWE-611
NVD
Published: 2019-11-19
Updated: 2024-11-21

Summary

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

Vulnerable Configurations

Part Description Count
Application
Apache
31

Common Weakness Enumeration (CWE)

References