What is CVE-2023-40037?

CVE-2023-40037 is a medium-severity vulnerability in Apache Nifi, classified under Incomplete List of Disallowed Inputs. CVSS score: 6.5/10. Published 2023-08-18.

How severe is CVE-2023-40037?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2023-40037 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Nifi

CVE-2023-40037

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.

EPSS: 0.015 (72.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Apache Nifi
Apache Software Foundation Nifi — versions 1.21.0

Weakness classification (CWE)

Public proof-of-concept exploits

References

security@apache.org (release-notes, Vendor Advisory)
security@apache.org (vendor-advisory, Mailing List)
security@apache.org (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-40037?: CVE-2023-40037 is a medium-severity vulnerability in Apache Nifi, classified under Incomplete List of Disallowed Inputs. CVSS score: 6.5/10. Published 2023-08-18.
How severe is CVE-2023-40037?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2023-40037 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.