SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2023-22832

Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references.

HIGH 7.5EPSS 1.41%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

CVSS 3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
1.41% probability · 71th percentile
CISA KEV
Not listed
Weakness
CWE-611
Affected
apache/nifi
Source
security@apache.org

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.