CVE Vulnerability

CVE-2019-10080

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://nifi.apache.org/security.html#CVE-2019-10080 Vendor Advisory
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
https://www.oracle.com/security-alerts/cpuApr2021.html
Configurations

Configuration 1

cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*
Information

Published : 2019-11-19 10:15

Updated : 2021-06-14 06:15

NVD link : CVE-2019-10080

Mitre link : CVE-2019-10080

Products Affected
No products.
CWE
CWE-611

Improper Restriction of XML External Entity Reference