Xxe

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

Information Disclosure

Fabric is vulnerable to information disclosure. When uploading templates using the uploadtemplate function, if the intended destination is invalid, the file ends up world-readable in the home folder...