CVE-2023-40037CWE-184

Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

published August 18, 2023

CVSS
—
EPSS
2%
Percentile
81.4
In the wild
Unconfirmed
What it is

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02085 · 81.4th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2023-08-18T21:54Z
EPSS history
Timeline
  • 18 AUG 21:54Z
    Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
    cvelistv5