Read the docs
TI-2018-01212 Aliases CVE-2018-1309GHSA-42wx-65g4-5cxv

XML external entity injection in Apache NiFi

Priority MEDIUM 49CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Why it matters now

EPSS 0.04436 91st percentileScored 2026-11-07
Fix Fixed org.apache.nifi:nifi-standard-processors (Maven): 1.6.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache NiFi0.1.0 - 1.5.0—No fix listedCNA
—org.apache.nifi:nifi-standard-processors (Maven)0.1.0 to before 1.6.01.6.0Patch availableGHSA-42wx-65g4-5cxv
  • Apache NiFi VendorApache Affected 0.1.0 - 1.5.0 Fixed in — No fix listed CNA
  • org.apache.nifi:nifi-standard-processors (Maven) Vendor— Affected 0.1.0 to before 1.6.0 Fixed in 1.6.0 Patch available GHSA-42wx-65g4-5cxv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*before 1.6.0VulnerableApache
  • cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-42wx-65g4-5cxv org.apache.nifi:nifi-standard-processors (Maven) Fixed in 1.6.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1309
  2. 2026-10-03 Alias added: GHSA-42wx-65g4-5cxv

References

Patch 1

Advisory 1

Other 3

  • TI-2023-17293 Apache NiFi: Potential Code Injection with Database Services using H2 CVSS 3.1HIGH 8.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-07411 Deserialization of untrusted data in Apache Commons Beanutils CVSS 3.1HIGH 7.3
  • TI-2017-11471 Improper input validation in Apache NiFi CVSS 3.0CRITICAL 9.8
  • TI-2021-03489 Deserialization of untrusted data in jackson-databind CVSS 3.1HIGH 8.1
  • TI-2017-03637 Injection in Apache NiFi CVSS 3.0CRITICAL 9.8
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences