CVE-2023-34468 – org.apache.nifi:nifi-dbcp-service-nar

Package

Manager: maven
Name: org.apache.nifi:nifi-dbcp-service-nar
Vulnerable Version: >=0.0.2 <1.22.0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.77205 pctl0.98933

Details

Apache NiFi vulnerable to Code Injection The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Metadata

Created: 2023-06-12T18:30:18Z
Modified: 2025-02-13T18:58:07Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-xm2m-2q6h-22jw/GHSA-xm2m-2q6h-22jw.json
CWE IDs: ["CWE-94"]
Alternative ID: GHSA-xm2m-2q6h-22jw
Finding: F184
Auto approve: 1