description: In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).
problem types: Information disclosure by XXE
affected:
{
product: Apache NiFi
vendor: n/a
versions:
status: affected, version: Apache NiFi 1.0.0 to 1.11.4
}