Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-mm3u-4acx-e3hj

Summary

Apache NiFi Code Injection vulnerability
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

Aliases

alias	CVE-2023-36542

alias	GHSA-r969-8v3h-23v9

Fixed_packages

url	pkg:maven/org.apache.nifi/nifi@1.23.0
purl	pkg:maven/org.apache.nifi/nifi@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.23.0

url	pkg:maven/org.apache.nifi/nifi-cdc-mysql-bundle@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-cdc-mysql-bundle@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-cdc-mysql-bundle@1.23.0

url	pkg:maven/org.apache.nifi/nifi-dbcp-service@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-dbcp-service@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-dbcp-service@1.23.0

url	pkg:maven/org.apache.nifi/nifi-hadoop-dbcp-service@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-hadoop-dbcp-service@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-hadoop-dbcp-service@1.23.0

url	pkg:maven/org.apache.nifi/nifi-hbase_2-client-service@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-hbase_2-client-service@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-hbase_2-client-service@1.23.0

url	pkg:maven/org.apache.nifi/nifi-hikari-dbcp-service@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-hikari-dbcp-service@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-hikari-dbcp-service@1.23.0

url	pkg:maven/org.apache.nifi/nifi-jms-processors@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-jms-processors@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-jms-processors@1.23.0

url	pkg:maven/org.apache.nifi/nifi-record-serialization-services@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-record-serialization-services@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-record-serialization-services@1.23.0

url	pkg:maven/org.apache.nifi/nifi-standard-processors@1.23.0
purl	pkg:maven/org.apache.nifi/nifi-standard-processors@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-standard-processors@1.23.0

Affected_packages

url pkg:maven/org.apache.nifi/nifi@0.0.2

purl pkg:maven/org.apache.nifi/nifi@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

vulnerability	VCID-uwnc-5qk4-eqgw

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@0.0.2

url pkg:maven/org.apache.nifi/nifi@1.22.0

purl pkg:maven/org.apache.nifi/nifi@1.22.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.22.0

url pkg:maven/org.apache.nifi/nifi-cdc-mysql-bundle@0.0.2

purl pkg:maven/org.apache.nifi/nifi-cdc-mysql-bundle@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-cdc-mysql-bundle@0.0.2

url pkg:maven/org.apache.nifi/nifi-dbcp-service@0.0.2

purl pkg:maven/org.apache.nifi/nifi-dbcp-service@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-dbcp-service@0.0.2

url pkg:maven/org.apache.nifi/nifi-hadoop-dbcp-service@0.0.2

purl pkg:maven/org.apache.nifi/nifi-hadoop-dbcp-service@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-hadoop-dbcp-service@0.0.2

url pkg:maven/org.apache.nifi/nifi-hbase_2-client-service@0.0.2

purl pkg:maven/org.apache.nifi/nifi-hbase_2-client-service@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-hbase_2-client-service@0.0.2

url pkg:maven/org.apache.nifi/nifi-hikari-dbcp-service@0.0.2

purl pkg:maven/org.apache.nifi/nifi-hikari-dbcp-service@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

vulnerability	VCID-uwnc-5qk4-eqgw

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-hikari-dbcp-service@0.0.2

url pkg:maven/org.apache.nifi/nifi-jms-processors@0.0.2

purl pkg:maven/org.apache.nifi/nifi-jms-processors@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-jms-processors@0.0.2

url pkg:maven/org.apache.nifi/nifi-record-serialization-services@0.0.2

purl pkg:maven/org.apache.nifi/nifi-record-serialization-services@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-record-serialization-services@0.0.2

url pkg:maven/org.apache.nifi/nifi-standard-processors@0.0.2

purl pkg:maven/org.apache.nifi/nifi-standard-processors@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi-standard-processors@0.0.2

References

reference_url	http://seclists.org/fulldisclosure/2023/Jul/43
reference_id
reference_type
scores
url	http://seclists.org/fulldisclosure/2023/Jul/43

reference_url	https://github.com/apache/nifi
reference_id
reference_type
scores
url	https://github.com/apache/nifi

reference_url	https://github.com/apache/nifi/commit/532578799c
reference_id
reference_type
scores
url	https://github.com/apache/nifi/commit/532578799c

reference_url	https://issues.apache.org/jira/browse/NIFI-11744
reference_id
reference_type
scores
url	https://issues.apache.org/jira/browse/NIFI-11744

reference_url	https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof
reference_id
reference_type
scores
url	https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof

reference_url	https://nifi.apache.org/security.html#CVE-2023-36542
reference_id
reference_type
scores
url	https://nifi.apache.org/security.html#CVE-2023-36542

reference_url	http://www.openwall.com/lists/oss-security/2023/07/29/1
reference_id
reference_type
scores
url	http://www.openwall.com/lists/oss-security/2023/07/29/1

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-36542
reference_id	CVE-2023-36542
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-36542

reference_url	https://github.com/advisories/GHSA-r969-8v3h-23v9
reference_id	GHSA-r969-8v3h-23v9
reference_type
scores
url	https://github.com/advisories/GHSA-r969-8v3h-23v9

Weaknesses

cwe_id	94
name	Improper Control of Generation of Code ('Code Injection')
description	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mm3u-4acx-e3hj

Vulnerability Instance