What is GHSA-hxjp-q6c3-38fx?

GHSA-hxjp-q6c3-38fx is a security advisory published by GitHub Security Advisories with High severity. XML External Entity Reference in Apache NiFi

Which CVE IDs does GHSA-hxjp-q6c3-38fx cover?

GHSA-hxjp-q6c3-38fx covers the following CVE IDs: CVE-2023-22832. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hxjp-q6c3-38fx?

GHSA-hxjp-q6c3-38fx has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hxjp-q6c3-38fx?

GHSA-hxjp-q6c3-38fx affects 1 product, including: maven/org.apache.nifi:nifi-ccda-processors:\u003e= 1.2.0, \u003c 1.20.0.

GHSA-hxjp-q6c3-38fxHighCVSS 7.5

XML External Entity Reference in Apache NiFi

Vendor

GitHub Security Advisories

Published

February 10, 2023

Last Modified

October 14, 2024

🔗 CVE IDs covered (1)

CVE-2023-22832 →

📋 Description

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

🎯 Affected products1

maven/org.apache.nifi:nifi-ccda-processors:>= 1.2.0, < 1.20.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-22832
https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w
https://nifi.apache.org/security.html#CVE-2023-22832
https://github.com/apache/nifi/commit/e966336e8966cf0cbbd12a2c4f2d73a7ceb75cd8
https://github.com/advisories/GHSA-hxjp-q6c3-38fx