CVE-2020-13940 Improper Restriction of XML External Entity Reference in Apache NiFi

What is CVE-2020-13940?

CVE-2020-13940 is a medium-severity vulnerability in Apache Nifi, published on 1 Oct 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

Weakness: CWE-611

Which versions are affected by CVE-2020-13940?

3 open source packages ship an affected version, including org.apache.nifi:nifi and nifi. It affects 1 product.

Products include Apache Nifi.

How do I fix CVE-2020-13940?

Upgrade org.apache.nifi:nifi to 1.12.0-RC1 or later.

Is CVE-2020-13940 being exploited?

There is no known exploitation of CVE-2020-13940 in the wild and no public exploit code.

Other vulnerabilities in Apache Nifi

• CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi Critical 9.8
• CVE-2017-15697 Apache NiFi XSS issue in context path handling Critical 9.8
• CVE-2017-5636 Injection in Apache NiFi Critical 9.8
• CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests High 8.8
• CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources High 8.8

All Apache Nifi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-nifi-2020-13940, GHSA-q4xf-3pmq-3hw8.