XXE attack in Apache Nifi - CVE-2018-1309
Published: May 29, 2018
Vulnerability identifier: #VU13038
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-1309
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apache Foundation
Affected software:
Apache Nifi
Apache Nifi
Detailed vulnerability description
The vulnerability allows a remote attacker to conduct XXE-attack on the target system.
The vulnerability exists due to improper parsing of XML content by the SplitXML processor. A remote attacker can send a specially crafted request that submits malicious XML content to the targeted system and execute arbitrary code or access sensitive information on the system, which could be used to conduct further attacks.
How to mitigate CVE-2018-1309
Update to version 1.6.