CVE-2023-36542 High · 8.8 EPSS 1.9%

Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources

Apache Software Foundation · Apache NiFi

Official description · CVE.org

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

Breakdown

59.0 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 14 months after disclosure.

Disclosed29 Jul 2023day 0
First seen exploitedVulnCheck KEV evidence18 Sep 2024+14 mo

See the family tree

4 related vulnerabilities in the same code over 10 weeks. The latest fix listed for nifi-jms-processors is 1.23.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2023-34212NiFi: Potential Deserialization of Untrusted Data with JNDI in…12 Jun 2023
same family
CVE-2023-34468NiFi: Potential Code Injection with Database Services using H212 Jun 2023
relatedHigh
Why these are linked:
- Fixed one release later1.22.0 → 1.23.0 (org.apache.nifi:nifi-hikari-dbcp-service)
- Same code patched: HikariCPConnectionPool.java (machine-matched)commit 4faf3ea commit 5325787
This CVECVE-2023-36542NiFi: Potential Code Injection with Properties Referencing…29 Jul 2023
relatedHigh
Why these are linked:
- Fixed one release later1.23.0 → 1.23.1 (org.apache.nifi:nifi-jms-processors)
- Same code patched: HikariCPConnectionPool.java (machine-matched)commit 5325787 commit 064550a
- Similar weakness in the same product (machine-matched)same product + description similarity
CVE-2023-40037NiFi: Incomplete Validation of JDBC and JNDI Connection URLs18 Aug 2023

Fixes in nifi-jms-processorsMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.22.0CVE-2023-3421212 Jun 2023
1.23.0CVE-2023-3654229 Jul 2023
1.23.1CVE-2023-4003718 Aug 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

8 packages in 1 ecosystem. No single main package: each of these ships the affected code.

Mavenorg.apache.nifi:nifi-cdc-mysql-bundle
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9
Mavenorg.apache.nifi:nifi-jms-processors
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9
Mavenorg.apache.nifi:nifi-standard-processors
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9
Mavenorg.apache.nifi:nifi-dbcp-service
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9
Mavenorg.apache.nifi:nifi-hikari-dbcp-service
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9
Mavenorg.apache.nifi:nifi-hadoop-dbcp-service
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9
Mavenorg.apache.nifi:nifi-hbase_2-client-service
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9
Mavenorg.apache.nifi:nifi-record-serialization-services
Affected: 0.0.2 up to 1.23.0Upgrade to 1.23.0 or later
GHSA-r969-8v3h-23v9

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 6 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2023-2137

No public exploit code found.

, 30 Oct 2026

1.9%Top 20%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 79.7%).

3.1

8.8High · 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 773 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.7968 15.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses6 pulses 1.9/3

CVSS base scorebase score 8.8 6.2/7

End-of-life productsupported or unknown 0.0

Total59.0

Record

Published: 29 Jul 2023
Modified: 13 Feb 2025
: CWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in nifi-jms-processorsMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

What security researchers reported

Also mentioned in 6 community threat pulses (AlienVault OTX)

References

release-notes 1

vendor-advisory 1

Other 2

techniques