Description
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/12/17/1
https://nifi.apache.org/security.html#1.15.1-vulnerabilities
Related Vulnerabilities
CVE-2019-16775 Vulnerability in maven package org.webjars.bower:npm
CVE-2023-26486 Vulnerability in maven package org.webjars.bowergithub.vega:vega
CVE-2020-7676 Vulnerability in maven package org.webjars.bowergithub.angular:angular
CVE-2021-26920 Vulnerability in maven package org.apache.druid:druid-core
CVE-2021-43849 Vulnerability in npm package cordova-plugin-fingerprint-aio