CVE-2022-29265

Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services.

• CWE-611
• CWE-611

• https://lists.apache.org/thread/47od9kr9n4cyv0mv81jh3pkyx815kyjlMailing List, Mitigation, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2022-29265Vendor Advisory
• https://lists.apache.org/thread/47od9kr9n4cyv0mv81jh3pkyx815kyjlMailing List, Mitigation, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2022-29265Vendor Advisory

Published

Apr 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29257Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2022-29258XWiki Platform Filter UI provides a generic user interface t…6.1
• CVE-2022-2926The Download Manager WordPress plugin before 3.2.55 does not…4.9
• CVE-2022-29262Improper buffer restrictions in some Intel(R) Server Board B…6.7
• CVE-2022-29263On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x v…7.8
• CVE-2022-29264An issue was discovered in coreboot 4.13 through 4.16. On AP…9.8
• CVE-2022-29266In APache APISIX before 3.13.1, the jwt-auth plugin has a se…7.5
• CVE-2022-29268Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-29269In Nagios XI through 5.8.5, in the schedule report function,…6.5
• CVE-2022-2927Weak Password Requirements in GitHub repository notrinos/not…9.8
• CVE-2022-29270In Nagios XI through 5.8.5, it is possible for a user withou…4.3
• CVE-2022-29271In Nagios XI through 5.8.5, a read-only Nagios user (due to …6.5