CVE-2023-22832— Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes
Quick assessment
Affected
Apache Software Foundation Apache NiFi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache NiFi是美国阿帕奇（Apache）基金会的一套数据处理和分发系统。该系统主要用于数据路由、转换和系统中介逻辑。 Apache NiFi 1.2.0版本至1.19.1版本存在代码问题漏洞，该漏洞源于没有限制XML外部实体引用。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-22832
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes
Source: CVE Program / CVE List V5
Vulnerability Description
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references.
Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references.
The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache NiFi 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache NiFi是美国阿帕奇（Apache）基金会的一套数据处理和分发系统。该系统主要用于数据路由、转换和系统中介逻辑。 Apache NiFi 1.2.0版本至1.19.1版本存在代码问题漏洞，该漏洞源于没有限制XML外部实体引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache NiFi | 1.2.0 ~ 1.19.1 | - |
|
II. Public POCs for CVE-2023-22832
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-22832
请登录查看更多情报信息。
Mailing List Discussions for CVE-2023-22832 (1)
-
https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w vendor-advisory
Other References for CVE-2023-22832 (1)
-
https://nifi.apache.org/security.html#CVE-2023-22832 technical-description
IV. Related Vulnerabilities
Same product: Apache NiFi
-
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Conte -
CVE-2026-81866
Apache NiFi: Missing Authorization for Assets and Secrets Re -
CVE-2026-82561
Apache NiFi: Missing Authorization for Components Referenced -
CVE-2026-86089
Apache NiFi: Missing Process Group Authorization for Connect -
CVE-2026-68981
Apache NiFi: Uncontrolled Resource Consumption through Decom
Same vendor: Apache Software Foundation
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious do -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
Same weakness: CWE-611
-
CVE-2026-88789
Apache Camel Quarkus: Camel Quarkus: Forced Xalan Transforme -
CVE-2026-102127
Kiteworks Email Protection Gateway Improper Restriction of X -
CVE-2026-82376
Apache Roller: XML external entity processing in trackback r -
CVE-2026-82386
Apache Roller: XML external entity processing in OPML bookma -
CVE-2026-93030
FortiManager 4.x XML外部实体注入漏洞
V. Comments for CVE-2023-22832
No comments yet