CVE-2018-1309 json
Improper Restriction of XML External Entity Reference in Apache NiFi
published 2018-05-23 8 y ago modified 2026-06-17 4 mo ago also GHSA-42wx-65g4-5cxv , EUVD-2022-2273
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.4%
- EPSS 4.4% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Patch / fix
- maven org.apache.nifi:nifi-standard-processors 1.6.0
- apache nifi 1.6.0
Exploit prediction
4.44% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.nifi:nifi-standard-processors | >=0.1.0, <1.6.0 |
1.6.0 |
Affected products
- Apache Software Foundation Apache NiFi
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
nifi.apache.org
/security.html#CVE-2018-1309
web, patch, vendor-advisory
-
github.com
/apache/nifi/commit/28067a29fd13cdf8e21b440fc65c6dd67872522f
web
-
nvd.nist.gov
/vuln/detail/CVE-2018-1309
advisory
-
github.com
/apache/nifi
package
-
issues.apache.org
/jira/browse/NIFI-4869
web
Sources
- CVE List CVE-2018-1309
- GitHub Advisory GHSA-42wx-65g4-5cxv
- NVD CVE-2018-1309
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.