CVE-2023-34212

Katalog CVE

CVSS 6.5 · Medium EPSS 2,4%

Kerentanan Deserialization of Untrusted Data pada apache nifi. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Rincian

Terbit di NVD

12 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5 mailing list · advisory vendor
• https://nifi.apache.org/security.html#CVE-2023-34212 release notes · advisory vendor
• http://www.openwall.com/lists/oss-security/2023/06/12/2 mailing list · advisory pihak ketiga