CVE-2020-13940

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted adminis...

Original description

The description as published by the source.

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami nifi

[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"last_affected":"1.11.4"}]}]

References

advisory nifi.apache.org
web nvd.nist.gov