CVE-2023-22832

Name: CVE-2023-22832
Creator: NVD / NIST
Published: 2023-02-10T08:15:12.843+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 1.41%

Last modified Jun 17, 2026

CVE-2023-22832 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor. . EPSS estimates a 1.41% chance of exploitation in the next 30 days.

Description

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

1.41%

69.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Apache	Nifi	>= 1.2.0, <= 1.19.1

References

https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3wMailing List, Vendor Advisory
https://nifi.apache.org/security.html#CVE-2023-22832Vendor Advisory
https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3wMailing List, Vendor Advisory
https://nifi.apache.org/security.html#CVE-2023-22832Vendor Advisory

Timeline

Published: Feb 10, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-22832?

How severe is CVE-2023-22832?

CVE-2023-22832 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.41% probability of exploitation in the next 30 days.

How do I fix CVE-2023-22832?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-22832?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST