PT-2023-24742 · Apache · Apache Nifi

Mal + 2 · Publicado 2023-06-12 · Atualizado 2025-09-12 · CVE-2023-34212

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.8.0 through 1.21.0

Description The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.

Recommendations Upgrade to version 1.22.0 or later, which fixes this issue.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BIT-NIFI-2023-34212

CVE-2023-34212

GHSA-65WH-G8X8-GM2H

Produtos afetados

Apache Nifi

Referências · 16

• 🔥 https://github.com/mbadanoiu/CVE-2023-34212 · Exploit
• https://github.com/apache/nifi · Nota
• https://github.com/apache/nifi/pull/7313 · Nota
• https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6 · Nota
• https://nifi.apache.org/security.html#CVE-2023-34212 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/06/12/2 · Nota
• https://osv.dev/vulnerability/BIT-nifi-2023-34212 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-34212 · Aviso do Fabricante
• https://t.me/cvenotify/52150 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/9462 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-65wh-g8x8-gm2h · Aviso do Fabricante
• https://t.me/pentestingnews/41411 · Publicação no Telegram
• https://t.me/ckure/13261 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-34212 · Nota de Segurança
• https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5 · Aviso do Fabricante