CVE-2021-44145: 
Java vulnerability analysis and mitigation

CVE-2021-44145 affects the TransformXML processor in Apache NiFi versions before 1.15.1. The vulnerability was discovered by DangKhai at Viettel Cyber Security and disclosed on December 15, 2021. This security issue allows an authenticated user to configure an XSLT file that could potentially reveal sensitive information through malicious external entity calls (NVD, Apache Security).

The vulnerability exists in the TransformXML processor where authenticated users could configure XSLT files containing malicious external entity calls. The issue has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

If exploited, this vulnerability could lead to the disclosure of sensitive information through XML external entity calls. The impact is limited to scenarios where an authenticated user configures malicious XSLT files in the TransformXML processor (OSS Security).

The vulnerability was fixed in Apache NiFi version 1.15.1. The fix involves applying the Secure processing property in TransformXML to the configured XSLT file as well as flow files being transformed. Users running any previous NiFi release should upgrade to version 1.15.1 (Apache Security).