GitHub Advisoryadvisory · Maven

GHSA-xm2m-2q6h-22jw Apache NiFi vulnerable to Code Injection

HIGH Published 2023-06-12 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-34468
Ecosystem
Maven
Packages
org.apache.nifi:nifi-dbcp-base, org.apache.nifi:nifi-hikari-dbcp-service, org.apache.nifi:nifi-dbcp-service-nar
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2023-06-12

Affected packages

• Maven org.apache.nifi:nifi-dbcp-base: >= 0.0.2, < 1.22.0 → fixed in 1.22.0 • Maven org.apache.nifi:nifi-hikari-dbcp-service: >= 0.0.2, < 1.22.0 → fixed in 1.22.0 • Maven org.apache.nifi:nifi-dbcp-service-nar: >= 0.0.2, < 1.22.0 → fixed in 1.22.0

Description

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2023-34468 The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References