CVE-2019-10080: Apache NiFi information disclosure by XXE
Summary
CVE-2019-10080: Apache NiFi information disclosure by XXE. Affects org.apache.nifi:nifi-security versions >= 1.3.0, < 1.10.0. Fixed in 1.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration tool that enables the automation of data flows between different systems. It provides a web-based interface for designing, managing, and monitoring data flows. The NiFi instance uses various components and libraries, including Java, Jersey, and Apache. These components play a crucial role in the functionality and security of the NiFi instance.
Vulnerability Detail
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. This XML file could exploit XML External Entity (XXE) vulnerabilities, enabling it to make external calls to services and reveal sensitive information. In this case, the XXE vulnerability could be used to disclose the versions of Java, Jersey, and Apache that the NiFi instance uses. This information can be valuable for attackers to identify potential vulnerabilities or weaknesses in the NiFi instance.
How To Fix
Latest published version: 1.11.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the XMLFileLookupService. This can be done by modifying the NiFi configuration file and removing or commenting out the relevant XMLFileLookupService configuration. However, it is important to note that disabling this service may impact the functionality of certain features or workflows that rely on it.
Conclusion
The Apache NiFi instance is vulnerable to an XXE vulnerability that allows the disclosure of sensitive information. To mitigate this issue, it is recommended to upgrade to NiFi version 1.10.0 or later. If immediate upgrade is not possible, disabling the XMLFileLookupService can serve as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-security →
FAQ
Apache NiFi is an open-source data integration tool that facilitates the automation of data flows between different systems. It provides a web-based interface for designing, managing, and monitoring data flows.
An XML External Entity (XXE) vulnerability is a type of security flaw that allows an attacker to exploit XML parsing functionality to disclose sensitive information or perform other malicious actions.
This vulnerability can disclose information such as the versions of Java, Jersey, and Apache that the NiFi instance uses. This information can be valuable for attackers to identify potential vulnerabilities or weaknesses in the NiFi instance.
To fix this vulnerability, it is recommended to upgrade to NiFi version 1.10.0 or later. This version includes the necessary security patches to mitigate the XXE vulnerability.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the XMLFileLookupService. However, it is important to note that disabling this service may impact the functionality of certain features or workflows that rely on it.
