CVE-2021-44145

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache NiFi	>= Apache NiFi, <= 1.15.0

References

http://www.openwall.com/lists/oss-security/2021/12/17/1Mailing List, Third Party Advisory
https://nifi.apache.org/security.html#1.15.1-vulnerabilitiesVendor Advisory
http://www.openwall.com/lists/oss-security/2021/12/17/1Mailing List, Third Party Advisory
https://nifi.apache.org/security.html#1.15.1-vulnerabilitiesVendor Advisory

Timeline

Published: Dec 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-441475.5An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose loc CVE-2021-441486.1GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an S CVE-2021-441497.8An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks secu CVE-2021-44154.3The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is du CVE-2021-441507.5The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.CVE-2021-441517.5An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing CVE-2021-441529.8An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an una CVE-2021-441537.2An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbi CVE-2021-441547.2An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then CVE-2021-441555.3An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is vali CVE-2021-441588.0ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authentica CVE-2021-441599.84MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshel