CVE-2020-13940

2020-10-0120:15:13

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.9%

JSON

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

CPENameOperatorVersion
nifieqrel/nifi-1.4.0
nifieqnifi-1.11.2-RC1
nifieqnifi-1.6.0-RC3
nifieqnifi-1.1.0-RC2
nifieqrel/nifi-1.11.3
nifieqrel/nifi-1.11.0
nifieqnifi-1.10.0-RC3
nifieqnifi-1.11.0-RC3
nifieqrel/nifi-1.11.2
nifieqrel/nifi-1.10.0

Name	Operator	Version
nifi	eq	rel/nifi-1.4.0
nifi	eq	nifi-1.11.2-RC1
nifi	eq	nifi-1.6.0-RC3
nifi	eq	nifi-1.1.0-RC2
nifi	eq	rel/nifi-1.11.3
nifi	eq	rel/nifi-1.11.0
nifi	eq	nifi-1.10.0-RC3
nifi	eq	nifi-1.11.0-RC3
nifi	eq	rel/nifi-1.11.2
nifi	eq	rel/nifi-1.10.0