cvelistv5 - CVE-2017-12623

CVE-2017-12623

Vulnerability from cvelistv5

Published

2017-10-10 18:00

Modified

2024-09-16 16:17

Severity ?

Summary

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

References

▼	URL	Tags
	security@apache.org	https://nifi.apache.org/security.html#CVE-2017-12623	Vendor Advisory

Impacted products

▼	Vendor	Product
	Apache Software Foundation	Apache NiFi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:43:56.424Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nifi.apache.org/security.html#CVE-2017-12623"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache NiFi",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0 to 1.3.0"
            }
          ]
        }
      ],
      "datePublic": "2017-10-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T17:57:01",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nifi.apache.org/security.html#CVE-2017-12623"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2017-10-02T00:00:00",
          "ID": "CVE-2017-12623",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache NiFi",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.0.0 to 1.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nifi.apache.org/security.html#CVE-2017-12623",
              "refsource": "CONFIRM",
              "url": "https://nifi.apache.org/security.html#CVE-2017-12623"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-12623",
    "datePublished": "2017-10-10T18:00:00Z",
    "dateReserved": "2017-08-07T00:00:00",
    "dateUpdated": "2024-09-16T16:17:35.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-12623\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2017-10-10T18:29:00.197\",\"lastModified\":\"2017-11-05T21:11:53.913\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.\"},{\"lang\":\"es\",\"value\":\"Un usuario autorizado podr\u00eda subir una plantilla que contenga c\u00f3digo malicioso y que acceda a archivos sensibles mediante un ataque XEE (XML External Entity). La soluci\u00f3n para manejar entidades externas XML se aplic\u00f3 en la distribuci\u00f3n 1.4.0 de Apache NiFi. Los usuarios que ejecuten una distribuci\u00f3n 1.x anterior deben actualizarla a la distribuci\u00f3n adecuada.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-611\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nifi:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C028889E-44E8-4E54-9585-BF9B0EED5A9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nifi:1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06D38C76-98D2-41F1-9F0B-CEE05215AB4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nifi:1.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01B8572D-CA8D-4A41-B94A-A393A22B5B9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"76FDA5E5-6A45-4979-9317-75623A59089F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nifi:1.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF1BEC26-CB83-4209-893D-5EA6E08A0C4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nifi:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A509533F-ACD6-4290-BE2E-3EDBED60D43B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nifi:1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A169A8CB-29A5-4C44-AEF9-8995C9239874\"}]}]}],\"references\":[{\"url\":\"https://nifi.apache.org/security.html#CVE-2017-12623\",\"source\":\"security@apache.org\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2017-12623

Vulnerability from cvelistv5

ghsa-qj7f-j6h9-g5rq

Vulnerability from github

gsd-2017-12623

Vulnerability from gsd

Tags

Sightings

Nomenclature