Apache NiFi up to 1.21.0 deserialization

Summaryinfo

A vulnerability classified as problematic has been found in Apache NiFi up to 1.21.0. The affected element is an unknown function of the component JndiJmsConnectionFactoryProvider Controller Service. Performing a manipulation results in deserialization. This vulnerability is reported as CVE-2023-34212. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in Apache NiFi up to 1.21.0. This affects some unknown processing of the component JndiJmsConnectionFactoryProvider Controller Service. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 06/12/2023. The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2023-34212 since 05/30/2023. Neither technical details nor an exploit are publicly available.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Apache

Name

• NiFi

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion