Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29265

CVE-2022-29265:
Multiple components in Apache NiFi do not restrict XML External Entity references

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-29265
GHSA ID
GHSA-wc97-7623-rxwx
EPSS Score
0.77743%
CWE
CWE-611
Published
5/1/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.nifi:nifimaven>= 0.0.1, < 1.16.11.16.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability explicitly names three processors (EvaluateXPath, EvaluateXQuery, ValidateXml) and the Standard Content Viewer service as components with insecure XML parsing. In Java XML processing, XXE vulnerabilities typically occur when DocumentBuilderFactory/SAXParserFactory instances are created without disabling DTDs (FEATURE_SECURE_PROCESSING not enabled). The processors' onTrigger methods (main processing entry points) and the content viewer's XML rendering method would be where insecure parsing occurs. While exact code isn't available, the component names and vulnerability pattern strongly indicate these are the vulnerable entry points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** Ni*i is * syst*m to pro**ss *n* *istri*ut* **t*. Multipl* *ompon*nts in *p**** Ni*i *.*.* to *.**.* *o not r*stri*t XML *xt*rn*l *ntity r***r*n**s in t** ****ult *on*i*ur*tion. T** St*n**r* *ont*nt Vi*w*r s*rvi** *tt*mpts to r*solv* XML *xt*rn

Reasoning

T** vuln*r**ility *xpli*itly n*m*s t*r** pro**ssors (*v*lu*t*XP*t*, *v*lu*t*XQu*ry, V*li**t*Xml) *n* t** St*n**r* *ont*nt Vi*w*r s*rvi** *s *ompon*nts wit* ins**ur* XML p*rsin*. In J*v* XML pro**ssin*, XX* vuln*r**iliti*s typi**lly o**ur w**n *o*um*n