CVE-2021-44145

—

CVSS 3.1

6.5 medium

EPSS

2%p76

Published

Dec 17, 2021 (Dec 17, 2021)

Modified

Jun 17, 2026

Description

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

Vendors: apache
Products: nifi
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.