Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-bj2c-k1hr-nycy
Summary
Improper Restriction of XML External Entity Reference
In Apache NiFi, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).
Aliases
0
alias CVE-2020-13940
1
alias GHSA-q4xf-3pmq-3hw8
Fixed_packages
0
url pkg:maven/org.apache.nifi/nifi@1.12.0-RC1
purl pkg:maven/org.apache.nifi/nifi@1.12.0-RC1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.12.0-RC1
1
url pkg:maven/org.apache.nifi/nifi@1.12.0
purl pkg:maven/org.apache.nifi/nifi@1.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.12.0
Affected_packages
0
url pkg:maven/org.apache.nifi/nifi@1.0.0
purl pkg:maven/org.apache.nifi/nifi@1.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-5yn9-8juq-mkd9
3
vulnerability VCID-8ybn-5kck-d7fz
4
vulnerability VCID-bgn1-6ac8-53b2
5
vulnerability VCID-bj2c-k1hr-nycy
6
vulnerability VCID-cqqh-wp8z-jua2
7
vulnerability VCID-e3tg-8rmu-9ucb
8
vulnerability VCID-gxag-kxb4-n7ge
9
vulnerability VCID-jnfq-u9wb-k7dq
10
vulnerability VCID-ty4z-t2su-muc6
11
vulnerability VCID-uxfk-98ce-hfe8
12
vulnerability VCID-y1sd-wp8g-afcn
13
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.0.0
1
url pkg:maven/org.apache.nifi/nifi@1.0.1
purl pkg:maven/org.apache.nifi/nifi@1.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-5yn9-8juq-mkd9
3
vulnerability VCID-8ybn-5kck-d7fz
4
vulnerability VCID-bgn1-6ac8-53b2
5
vulnerability VCID-bj2c-k1hr-nycy
6
vulnerability VCID-cqqh-wp8z-jua2
7
vulnerability VCID-e3tg-8rmu-9ucb
8
vulnerability VCID-gxag-kxb4-n7ge
9
vulnerability VCID-jnfq-u9wb-k7dq
10
vulnerability VCID-ty4z-t2su-muc6
11
vulnerability VCID-uxfk-98ce-hfe8
12
vulnerability VCID-y1sd-wp8g-afcn
13
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.0.1
2
url pkg:maven/org.apache.nifi/nifi@1.1.0
purl pkg:maven/org.apache.nifi/nifi@1.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-5yn9-8juq-mkd9
3
vulnerability VCID-8ybn-5kck-d7fz
4
vulnerability VCID-bgn1-6ac8-53b2
5
vulnerability VCID-bj2c-k1hr-nycy
6
vulnerability VCID-cqqh-wp8z-jua2
7
vulnerability VCID-e3tg-8rmu-9ucb
8
vulnerability VCID-gxag-kxb4-n7ge
9
vulnerability VCID-jnfq-u9wb-k7dq
10
vulnerability VCID-m99c-5n4v-w7ec
11
vulnerability VCID-r6wb-vjgp-tubn
12
vulnerability VCID-ty4z-t2su-muc6
13
vulnerability VCID-uxfk-98ce-hfe8
14
vulnerability VCID-y1sd-wp8g-afcn
15
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.1.0
3
url pkg:maven/org.apache.nifi/nifi@1.1.1
purl pkg:maven/org.apache.nifi/nifi@1.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-5yn9-8juq-mkd9
3
vulnerability VCID-bgn1-6ac8-53b2
4
vulnerability VCID-bj2c-k1hr-nycy
5
vulnerability VCID-cqqh-wp8z-jua2
6
vulnerability VCID-e3tg-8rmu-9ucb
7
vulnerability VCID-gxag-kxb4-n7ge
8
vulnerability VCID-jnfq-u9wb-k7dq
9
vulnerability VCID-m99c-5n4v-w7ec
10
vulnerability VCID-r6wb-vjgp-tubn
11
vulnerability VCID-ty4z-t2su-muc6
12
vulnerability VCID-uxfk-98ce-hfe8
13
vulnerability VCID-y1sd-wp8g-afcn
14
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.1.1
4
url pkg:maven/org.apache.nifi/nifi@1.1.2
purl pkg:maven/org.apache.nifi/nifi@1.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-5yn9-8juq-mkd9
3
vulnerability VCID-bgn1-6ac8-53b2
4
vulnerability VCID-bj2c-k1hr-nycy
5
vulnerability VCID-cqqh-wp8z-jua2
6
vulnerability VCID-e3tg-8rmu-9ucb
7
vulnerability VCID-gxag-kxb4-n7ge
8
vulnerability VCID-jnfq-u9wb-k7dq
9
vulnerability VCID-ty4z-t2su-muc6
10
vulnerability VCID-uxfk-98ce-hfe8
11
vulnerability VCID-y1sd-wp8g-afcn
12
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.1.2
5
url pkg:maven/org.apache.nifi/nifi@1.2.0
purl pkg:maven/org.apache.nifi/nifi@1.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-5yn9-8juq-mkd9
3
vulnerability VCID-bgn1-6ac8-53b2
4
vulnerability VCID-bj2c-k1hr-nycy
5
vulnerability VCID-cqqh-wp8z-jua2
6
vulnerability VCID-e3tg-8rmu-9ucb
7
vulnerability VCID-grt2-a9zv-gkck
8
vulnerability VCID-gxag-kxb4-n7ge
9
vulnerability VCID-jnfq-u9wb-k7dq
10
vulnerability VCID-ty4z-t2su-muc6
11
vulnerability VCID-uxfk-98ce-hfe8
12
vulnerability VCID-y1sd-wp8g-afcn
13
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.2.0
6
url pkg:maven/org.apache.nifi/nifi@1.3.0
purl pkg:maven/org.apache.nifi/nifi@1.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-babh-856u-5qcj
3
vulnerability VCID-bgn1-6ac8-53b2
4
vulnerability VCID-bj2c-k1hr-nycy
5
vulnerability VCID-cqqh-wp8z-jua2
6
vulnerability VCID-e3tg-8rmu-9ucb
7
vulnerability VCID-g7v6-tmrk-tuer
8
vulnerability VCID-gxag-kxb4-n7ge
9
vulnerability VCID-jnfq-u9wb-k7dq
10
vulnerability VCID-uxfk-98ce-hfe8
11
vulnerability VCID-y1sd-wp8g-afcn
12
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.3.0
7
url pkg:maven/org.apache.nifi/nifi@1.4.0
purl pkg:maven/org.apache.nifi/nifi@1.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ps4-jf7z-nqf1
1
vulnerability VCID-49kq-6d3w-1ufx
2
vulnerability VCID-babh-856u-5qcj
3
vulnerability VCID-bgn1-6ac8-53b2
4
vulnerability VCID-bj2c-k1hr-nycy
5
vulnerability VCID-cqqh-wp8z-jua2
6
vulnerability VCID-g7v6-tmrk-tuer
7
vulnerability VCID-gxag-kxb4-n7ge
8
vulnerability VCID-jnfq-u9wb-k7dq
9
vulnerability VCID-uxfk-98ce-hfe8
10
vulnerability VCID-y1sd-wp8g-afcn
11
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.4.0
8
url pkg:maven/org.apache.nifi/nifi@1.5.0
purl pkg:maven/org.apache.nifi/nifi@1.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-49kq-6d3w-1ufx
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
6
vulnerability VCID-uxfk-98ce-hfe8
7
vulnerability VCID-y1sd-wp8g-afcn
8
vulnerability VCID-y5yt-6b5k-6yar
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.5.0
9
url pkg:maven/org.apache.nifi/nifi@1.6.0
purl pkg:maven/org.apache.nifi/nifi@1.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-49kq-6d3w-1ufx
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
6
vulnerability VCID-uxfk-98ce-hfe8
7
vulnerability VCID-y1sd-wp8g-afcn
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.6.0
10
url pkg:maven/org.apache.nifi/nifi@1.7.0
purl pkg:maven/org.apache.nifi/nifi@1.7.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
6
vulnerability VCID-uxfk-98ce-hfe8
7
vulnerability VCID-y1sd-wp8g-afcn
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.7.0
11
url pkg:maven/org.apache.nifi/nifi@1.7.1
purl pkg:maven/org.apache.nifi/nifi@1.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
6
vulnerability VCID-uxfk-98ce-hfe8
7
vulnerability VCID-y1sd-wp8g-afcn
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.7.1
12
url pkg:maven/org.apache.nifi/nifi@1.8.0
purl pkg:maven/org.apache.nifi/nifi@1.8.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
6
vulnerability VCID-qkvt-fdp4-uyd6
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.8.0
13
url pkg:maven/org.apache.nifi/nifi@1.9.0
purl pkg:maven/org.apache.nifi/nifi@1.9.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.9.0
14
url pkg:maven/org.apache.nifi/nifi@1.9.1
purl pkg:maven/org.apache.nifi/nifi@1.9.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.9.1
15
url pkg:maven/org.apache.nifi/nifi@1.9.2
purl pkg:maven/org.apache.nifi/nifi@1.9.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-babh-856u-5qcj
2
vulnerability VCID-bgn1-6ac8-53b2
3
vulnerability VCID-bj2c-k1hr-nycy
4
vulnerability VCID-g7v6-tmrk-tuer
5
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.9.2
16
url pkg:maven/org.apache.nifi/nifi@1.10.0
purl pkg:maven/org.apache.nifi/nifi@1.10.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-bgn1-6ac8-53b2
2
vulnerability VCID-bj2c-k1hr-nycy
3
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.10.0
17
url pkg:maven/org.apache.nifi/nifi@1.11.0
purl pkg:maven/org.apache.nifi/nifi@1.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-bj2c-k1hr-nycy
2
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.11.0
18
url pkg:maven/org.apache.nifi/nifi@1.11.1
purl pkg:maven/org.apache.nifi/nifi@1.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-bj2c-k1hr-nycy
2
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.11.1
19
url pkg:maven/org.apache.nifi/nifi@1.11.2
purl pkg:maven/org.apache.nifi/nifi@1.11.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-bj2c-k1hr-nycy
2
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.11.2
20
url pkg:maven/org.apache.nifi/nifi@1.11.3
purl pkg:maven/org.apache.nifi/nifi@1.11.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-bj2c-k1hr-nycy
2
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.11.3
21
url pkg:maven/org.apache.nifi/nifi@1.11.4
purl pkg:maven/org.apache.nifi/nifi@1.11.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7t7w-fq26-auc7
1
vulnerability VCID-bj2c-k1hr-nycy
2
vulnerability VCID-gxag-kxb4-n7ge
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.11.4
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-13940
reference_id
reference_type
scores
0
value 0.0096
scoring_system epss
scoring_elements 0.76822
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-13940
1
reference_url https://github.com/apache/nifi/commit/7f0416ee8bdcee95e28409cc6fae9c1394c2a798
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/nifi/commit/7f0416ee8bdcee95e28409cc6fae9c1394c2a798
2
reference_url https://nifi.apache.org/security#CVE-2020-13940
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nifi.apache.org/security#CVE-2020-13940
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-13940
reference_id CVE-2020-13940
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-13940
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 611
name Improper Restriction of XML External Entity Reference
description The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-bj2c-k1hr-nycy