#VU13038 XXE attack in Apache Nifi - CVE-2018-1309
Published: May 29, 2018
Vulnerability identifier: #VU13038
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-1309
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Apache Nifi
Apache Nifi
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to conduct XXE-attack on the target system.
The vulnerability exists due to improper parsing of XML content by the SplitXML processor. A remote attacker can send a specially crafted request that submits malicious XML content to the targeted system and execute arbitrary code or access sensitive information on the system, which could be used to conduct further attacks.
Remediation
Update to version 1.6.