CVE-2023-34468CWE-94

Apache NiFi: Potential Code Injection with Database Services using H2

High · published June 12, 2023

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1

8.8

EPSS

62%

Percentile

99.2

In the wild

Unconfirmed

What it is

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.61869 · 99.2th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2023-06-12T15:09Z

EPSS history

Timeline

12 JUN 15:09Z
Apache NiFi: Potential Code Injection with Database Services using H2
cvelistv5