PT-2023-4686 · Apache · Apache Nifi

Mal + 1 · Published 2023-08-18 · Updated 2025-09-12 · CVE-2023-40037

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.21.0 through 1.23.0

Description The issue is related to insufficient comparison in the Apache NiFi data processing platform. An authenticated and authorized user can bypass connection URL validation using custom input formatting, potentially allowing a remote attacker to gain unauthorized access to protected information. The vulnerability affects several Processors and Controller Services that support JDBC and JNDI JMS access.

Recommendations For Apache NiFi versions 1.21.0 through 1.23.0, upgrade to Apache NiFi 1.23.1 to enhance connection URL validation and introduce validation for additional related properties.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

CWE-697

Related Identifiers

BDU:2023-05103

BIT-NIFI-2023-40037

CVE-2023-40037

GHSA-23QF-3JF9-H3Q9

Affected Products

Apache Nifi

References · 17

• 🔥 https://github.com/mbadanoiu/CVE-2023-40037 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-40037 · Security Note
• https://bdu.fstec.ru/vul/2023-05103 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40037 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2023-40037 · Vendor Advisory
• https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-23qf-3jf9-h3q9 · Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2023-40037 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/064550aacc189f39d7ddd2c0446068adf250f1bf · Note
• https://github.com/apache/nifi/pull/7586 · Note
• https://t.me/cibsecurity/68850 · Telegram Post
• https://issues.apache.org/jira/browse/NIFI-11920 · Note
• https://t.me/cybersecuritytechnologies/9467 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1692699632759967864 · Twitter Post