XXE attack in Apache Nifi - CVE-2018-1309
Published: May 29, 2018
Vulnerability identifier: #VU13038
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N]
CVE-ID: CVE-2018-1309
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to conduct XXE-attack on the target system.
The vulnerability exists due to improper parsing of XML content by the SplitXML processor. A remote attacker can send a specially crafted request that submits malicious XML content to the targeted system and execute arbitrary code or access sensitive information on the system, which could be used to conduct further attacks.
Affected software
Apache Nifi
How to mitigate CVE-2018-1309
Update to version 1.6.