CVE-2017-12623

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache NiFi	1.0.0 to 1.3.0

References

https://nifi.apache.org/security.html#CVE-2017-12623Vendor Advisory
https://nifi.apache.org/security.html#CVE-2017-12623Vendor Advisory

Timeline

Published: Oct 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-126245.5Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message atta CVE-2017-126254.3Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined CVE-2017-126267.5Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, CVE-2017-126279.8In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain CVE-2017-126287.8The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be u CVE-2017-126299.8Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config A CVE-2017-126305.4In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effe CVE-2017-126318.8Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request For CVE-2017-126327.5A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host hea CVE-2017-126339.8The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnera CVE-2017-126349.8The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerab CVE-2017-126359.8Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x b