CVE-2020-13940

Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 01/10/2020 Updated: 05/10/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache nifi

Apache NiFi PMC would like to announce the discovery and resolution of CVE-2020-9486, CVE-2020-9487, CVE-2020-9491, and CVE-2020-13940 These issues have been resolved and a new version of the Apache NiFi project was released in accordance with the Apache Release Process Apache NiFi is an easy to use, powerful, and reliable system to process a ...

CWE-611 https://nifi.apache.org/security#CVE-2020-13940 https://nvd.nist.gov http://seclists.org/oss-sec/2020/q4/0

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-13940

Vulnerability Summary

Vulnerability Trend

Mailing Lists

References

Vulmon Search

About

Products

Connect