CVE-2021-44145: Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi
Summary
CVE-2021-44145: Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi. Affects org.apache.nifi:nifi versions < 1.15.1. Fixed in 1.15.1. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2021-44145 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache NiFi is an open-source data integration tool that provides a web-based interface to design, control, and manage the flow of data between systems. It allows users to create data pipelines by connecting various processors, which perform data transformation and routing tasks. NiFi is widely used in enterprise environments for data ingestion, processing, and distribution. However, a vulnerability has been discovered in NiFi versions prior to 1.15.1 that could expose sensitive information to unauthorized actors.
Vulnerability Detail
The vulnerability, identified as CVE-2021-44145, exists in the TransformXML processor of Apache NiFi. An authenticated user could configure an XSLT file that, if it includes malicious external entity calls, may reveal sensitive information. This vulnerability could be exploited by an attacker to gain unauthorized access to sensitive data, potentially leading to data breaches or other security incidents. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Latest published version: 2.12.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Apache NiFi version 1.15.1 or later.
Conclusion
In conclusion, Apache NiFi versions prior to 1.15.1 are vulnerable to exposure of sensitive information due to a flaw in the TransformXML processor. It is crucial for users to upgrade to the latest version to mitigate the risk of unauthorized access to sensitive data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi →
FAQ
Apache NiFi is an open-source data integration tool used for designing and managing data flow between systems.
The TransformXML processor in Apache NiFi allows users to apply XSLT transformations to XML data.
This vulnerability could allow an authenticated user to expose sensitive information by configuring a malicious XSLT file.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
To fix this vulnerability, upgrade to Apache NiFi version 1.15.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
