Search for vulnerabilities
Vulnerability details: VCID-3uyk-aqyg-aaas
Vulnerability ID VCID-3uyk-aqyg-aaas
Aliases CVE-2023-34212
GHSA-65wh-g8x8-gm2h
Summary The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-502 Deserialization of Untrusted Data
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.00902 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
epss 0.09781 https://api.first.org/data/v1/epss?cve=CVE-2023-34212
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-65wh-g8x8-gm2h
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-65wh-g8x8-gm2h
cvssv3.1 4.6 https://github.com/apache/nifi
generic_textual MODERATE https://github.com/apache/nifi
cvssv3.1 6.5 https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6
generic_textual MODERATE https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6
cvssv3.1 6.5 https://github.com/apache/nifi/pull/7313
generic_textual MODERATE https://github.com/apache/nifi/pull/7313
cvssv3.1 6.5 https://issues.apache.org/jira/browse/NIFI-11614
generic_textual MODERATE https://issues.apache.org/jira/browse/NIFI-11614
cvssv3.1 6.5 https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5
generic_textual MODERATE https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5
cvssv3.1 6.5 https://nifi.apache.org/security.html#CVE-2023-34212
generic_textual MODERATE https://nifi.apache.org/security.html#CVE-2023-34212
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-34212
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-34212
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2023/06/12/2
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2023/06/12/2
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-34212
https://github.com/apache/nifi
https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6
https://github.com/apache/nifi/pull/7313
https://issues.apache.org/jira/browse/NIFI-11614
https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5
https://nifi.apache.org/security.html#CVE-2023-34212
http://www.openwall.com/lists/oss-security/2023/06/12/2
cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*
CVE-2023-34212 https://nvd.nist.gov/vuln/detail/CVE-2023-34212
GHSA-65wh-g8x8-gm2h https://github.com/advisories/GHSA-65wh-g8x8-gm2h
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/apache/nifi
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/apache/nifi/pull/7313
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://issues.apache.org/jira/browse/NIFI-11614
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nifi.apache.org/security.html#CVE-2023-34212
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-34212
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-34212
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2023/06/12/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36545
EPSS Score 0.00081
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.