XXE in Apache Nifi
CVE-2022-29265
Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.026 (84.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Nifi
- Apache Software Foundation Nifi — versions 0.0.1 to 1.16.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (x_refsource_MISC, Vendor Advisory)
- security@apache.org (Mailing List, x_refsource_MISC, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-29265?
- CVE-2022-29265 is a high-severity vulnerability in Apache Nifi, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2022-04-30.
- How severe is CVE-2022-29265?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-29265 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.