XML External Entity (XXE) Injection

NiFi Standard Processors is vulnerable to xml external entity injection. The vulnerability exists in multiple components because EvaluateXPath, EvaluateXQuery and ValidateXml processors do not restrict XXE references when configured with default values which allows an attacker to send malicious X...

XML External Entities (XXE)

nifi-standard-processors is vulnerable to XML external entities XXE attacks. The vulnerability exists due to the lack of proper default configuration which disables external entities by default, allowing XXE attacks to occur...