{"id":"CVE-2017-12623","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-12623","generatedAt":"2026-10-29T00:35:04.604Z","title":"An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack.","description":"An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","published":"2017-10-10T18:29:00.000Z","lastModified":"2026-06-17T01:03:39.000Z","status":"Modified","sourceIdentifier":"security@apache.org","cvss":{"version":"3.0","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-611"],"affected":["apache/nifi"],"epss":{"score":0.0194,"percentile":0.80014,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.94%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://nifi.apache.org/security.html#CVE-2017-12623","tags":["Vendor Advisory"],"source":"security@apache.org"},{"url":"https://nifi.apache.org/security.html#CVE-2017-12623","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-12623","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}