Description
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/12/17/1
https://nifi.apache.org/security.html#1.15.1-vulnerabilities
Related Vulnerabilities
CVE-2020-6423 Vulnerability in npm package electron
CVE-2021-4264 Vulnerability in maven package org.webjars.npm:dustjs-linkedin
CVE-2019-1003077 Vulnerability in maven package org.jenkins-ci.plugins:audit2db
CVE-2017-9735 Vulnerability in maven package org.eclipse.jetty:jetty-util
CVE-2023-40344 Vulnerability in maven package org.jenkins-ci.plugins:delphix