cve.bz

CVE-2023-22832

7.5 highEPSS 1.4%

High (7.5) in apache nifi. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in org.apache.nifi:nifi-ccda-processors 1.20.0.

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE
CWE-611
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-hxjp-q6c3-38fxMavenorg.apache.nifi:nifi-ccda-processors>=1.2.0 <1.20.01.20.0

References

Check your stackJSON