What’s Vulnerable › Vulnerabilities

CVE-2021-44145: Apache NiFi information disclosure by XXE

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-17 · updated 2026-06-17
• Weakness: CWE-200

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

Affected products

• Apache Software Foundation Apache NiFi: from 0.1.0 before 1.15.1 — fixed in 1.15.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache NiFi 1.15.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/12/17/1
• https://nifi.apache.org/security.html#1.15.1-vulnerabilities
• http://www.openwall.com/lists/oss-security/2021/12/17/1
• https://nifi.apache.org/security.html#1.15.1-vulnerabilities

Get alerted when CVE-2021-44145 or the next vulnerability affects your stack