CVE-2023-40037

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi Apache NiFi 1210 through 1230 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs An authenticated and authorized user can bypass connection URL validation using cu

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 180 through 1210 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location Vendor Dis

CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi

CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 002 through 1210 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution Vendor Disclosure: The vendor's disclosure and fix for this vulnerabilit