PT-2023-4686 · Apache · Apache Nifi

Mal + 1 · Publicado 2023-08-18 · Atualizado 2025-09-12 · CVE-2023-40037

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.21.0 through 1.23.0

Description The issue is related to insufficient comparison in the Apache NiFi data processing platform. An authenticated and authorized user can bypass connection URL validation using custom input formatting, potentially allowing a remote attacker to gain unauthorized access to protected information. The vulnerability affects several Processors and Controller Services that support JDBC and JNDI JMS access.

Recommendations For Apache NiFi versions 1.21.0 through 1.23.0, upgrade to Apache NiFi 1.23.1 to enhance connection URL validation and introduce validation for additional related properties.

Exploit

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

CWE-697

Identificadores relacionados

BDU:2023-05103

BIT-NIFI-2023-40037

CVE-2023-40037

GHSA-23QF-3JF9-H3Q9

Produtos afetados

Apache Nifi

Referências · 17

• 🔥 https://github.com/mbadanoiu/CVE-2023-40037 · Exploit
• https://github.com/apache/nifi · Nota
• https://github.com/apache/nifi/commit/064550aacc189f39d7ddd2c0446068adf250f1bf · Nota
• https://github.com/apache/nifi/pull/7586 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-40037 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-05103 · Nota de Segurança
• https://t.me/cibsecurity/68850 · Publicação no Telegram
• https://issues.apache.org/jira/browse/NIFI-11920 · Nota
• https://t.me/cybersecuritytechnologies/9467 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1692699632759967864 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-40037 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/08/18/2 · Nota
• https://osv.dev/vulnerability/BIT-nifi-2023-40037 · Aviso do Fabricante
• https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687q · Aviso do Fabricante
• https://t.me/cvenotify/56899 · Publicação no Telegram