CVE-2019-10080

Description

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.418

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-10080 are fixed in Apache-nifi-security 1.10.0	Windows
Vulnerabilities CVE-2019-10083,CVE-2019-10080 are fixed in Apache-nifi-api 1.10.0	Windows
Vulnerabilities CVE-2019-10080 are fixed in Apache-nifi-security for Linux 1.10.0	Linux
Vulnerabilities CVE-2019-10083,CVE-2019-10080 are fixed in Apache-Nifi-api for Linux 1.10.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234