VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Oct 10, 2017· Updated Jun 17, 2026

CVE-2017-12623

CVE-2017-12623

Description

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.nifi:nifiMaven
>= 1.0.0, < 1.4.01.4.0

Affected products

9
  • Apache/Nifi7 versions
    cpe:2.3:a:apache:nifi:1.0.0:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:apache:nifi:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.3.0:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.nifi/nifi
    Range: >= 1.0.0, < 1.4.0
  • Apache/Apachecpe-rescue
    Range: 1.0.0 to 1.3.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.