What the vulnerability does
Description
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
CVSS base score
—
Key dates
Disclosure timeline
December 17, 2021
CVE published
August 4, 2024
Record updated
