CRITICAL🇵🇱 Wersja polska

CVE-2018-1309

CVSS 9.8v3.0pub. 2018-05-23upd. 2024-11-21

Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Nifi

    APP
    Apache
    < 1.6.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2017-15697CRITICAL9.8PL ✓same product

RCE przez nagłówek X-ProxyContextPath w Apache NiFi

CVE-2017-5636CRITICAL9.8PL ✓same product

Apache NiFi — injection przez deserializację łańcucha proxy w klastrze

CVE-2026-62354HIGH7.7PL ✓same product

Apache NiFi: nieautoryzowana walidacja Parameter Context przez użytkownika read-only

CVE-2026-68981HIGH8.8PL ✓same product

Apache NiFi: atak typu zip bomb przez gzip-encoded HTTP request

CVE-2026-44914HIGH7.5same product

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extensio...