CVE-2023-34212CWE-502

Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

published June 12, 2023

CVSS
—
EPSS
2%
Percentile
83.6
In the wild
Unconfirmed
What it is

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.

The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02351 · 83.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-06-12T15:14Z
EPSS history
Timeline
  • 12 JUN 15:14Z
    Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components
    cvelistv5