CVE-2023-40037 json
Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
published 2023-08-18 3 y ago modified 2026-09-08 2 mo ago also BIT-nifi-2023-40037 , EUVD-2023-2181 , GHSA-23qf-3jf9-h3q9
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
Patch / fix
- maven org.apache.nifi:nifi-dbcp-base 1.23.1
- maven org.apache.nifi:nifi-jms-processors 1.23.1
- maven org.apache.nifi:nifi-dbcp-service-api 1.23.1
- maven org.apache.nifi:nifi-dbcp-service-bundle 1.23.1
- bitnami nifi 1.23.1
- apache nifi 1.23.1
- github.com/apache/nifi@064550a commit
- github.com/apache/nifi#7586 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
2.08% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.nifi:nifi-dbcp-base | >=1.21.0, <1.23.1 |
1.23.1 |
| maven | org.apache.nifi:nifi-jms-processors | >=1.21.0, <1.23.1 |
1.23.1 |
| maven | org.apache.nifi:nifi-dbcp-service-api | >=1.21.0, <1.23.1 |
1.23.1 |
| maven | org.apache.nifi:nifi-dbcp-service-bundle | >=1.21.0, <1.23.1 |
1.23.1 |
| bitnami | nifi | >=1.21.0, <1.23.1 |
1.23.1 |
Affected products
- Apache Software Foundation Apache NiFi
Classification
References
-
github.com
/apache/nifi/pull/7586
web
-
github.com
/apache/nifi/commit/064550aacc189f39d7ddd2c0446068adf250f1bf
web
-
lists.apache.org
/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687q
vendor-advisory, web, mailing-list, discussion
-
nifi.apache.org
/security.html#CVE-2023-40037
release-notes, web, vendor-advisory, advisory
-
openwall.com
/lists/oss-security/2023/08/18/2
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-40037
advisory, web
-
github.com
/apache/nifi
package
-
issues.apache.org
/jira/browse/NIFI-11920
web
Sources
- CVE List CVE-2023-40037
- GitHub Advisory GHSA-23qf-3jf9-h3q9
- NVD CVE-2023-40037
- OSV BIT-nifi-2023-40037
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.