{"containers": {"cna": {"affected": [{"product": "Apache NiFi", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "1.0.0 to 1.3.0"}]}], "datePublic": "2017-10-02T00:00:00", "descriptions": [{"lang": "en", "value": "An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-10T17:57:01", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://nifi.apache.org/security.html#CVE-2017-12623"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "DATE_PUBLIC": "2017-10-02T00:00:00", "ID": "CVE-2017-12623", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache NiFi", "version": {"version_data": [{"version_value": "1.0.0 to 1.3.0"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "https://nifi.apache.org/security.html#CVE-2017-12623", "refsource": "CONFIRM", "url": "https://nifi.apache.org/security.html#CVE-2017-12623"}]}}}}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2017-12623", "datePublished": "2017-10-02T00:00:00", "dateReserved": "2017-08-07T00:00:00", "dateUpdated": "2017-10-10T17:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:nifi:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "C028889E-44E8-4E54-9585-BF9B0EED5A9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:nifi:1.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "06D38C76-98D2-41F1-9F0B-CEE05215AB4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:nifi:1.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "01B8572D-CA8D-4A41-B94A-A393A22B5B9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "76FDA5E5-6A45-4979-9317-75623A59089F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:nifi:1.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "DF1BEC26-CB83-4209-893D-5EA6E08A0C4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:nifi:1.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "A509533F-ACD6-4290-BE2E-3EDBED60D43B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:nifi:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "A169A8CB-29A5-4C44-AEF9-8995C9239874", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release."}, {"lang": "es", "value": "Un usuario autorizado podr\u00eda subir una plantilla que contenga c\u00f3digo malicioso y que acceda a archivos sensibles mediante un ataque XEE (XML External Entity). La soluci\u00f3n para manejar entidades externas XML se aplic\u00f3 en la distribuci\u00f3n 1.4.0 de Apache NiFi. Los usuarios que ejecuten una distribuci\u00f3n 1.x anterior deben actualizarla a la distribuci\u00f3n adecuada."}], "id": "CVE-2017-12623", "lastModified": "2017-11-05T21:11:53.913", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-10T18:29:00.197", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://nifi.apache.org/security.html#CVE-2017-12623"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}