CVE-2020-13940

—

CVSS 3.1

5.5 medium

EPSS

2%p79

Published

Oct 1, 2020 (Oct 1, 2020)

Modified

Jun 17, 2026

Description

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

Vendors: apache
Products: nifi
Weakness: CWE-611
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news0 stories

No ingested article mentions this CVE yet.