RCE in Apache Nifi
CVE-2023-34468
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.619 (99.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Nifi
- Apache Software Foundation Nifi — versions 0.0.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (release-notes, Release Notes, Vendor Advisory)
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- security@apache.org (Mailing List, Third Party Advisory)
- security@apache.org (VDB Entry, Third Party Advisory)
- security@apache.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-34468?
- CVE-2023-34468 is a high-severity vulnerability in Apache Nifi, classified under Code Injection. CVSS score: 8.8/10. Published 2023-06-12.
- How severe is CVE-2023-34468?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2023-34468 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.