CVE-2020-13940

2020-10-0119:55:16

apache

www.cve.org

0.0004 Low

EPSS

Percentile

12.9%

JSON

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

CNA Affected

[
  {
    "product": "Apache NiFi",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Apache NiFi 1.0.0 to 1.11.4"
      }
    ]
  }
]

References

nifi.apache.org/security#CVE-2020-13940

0.0004 Low

EPSS

Percentile

12.9%

JSON

Related for CVELIST:CVE-2020-13940