Description (CNA)
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache NiFi | affected Apache NiFi through 1.15.0 |
CWE
No CWE identifiers supplied.
References
- https://nifi.apache.org/security.html#1.15.1-vulnerabilities
- http://www.openwall.com/lists/oss-security/2021/12/17/1
ADP enrichment
No English description supplied.