Lucene search

Veracode Vulnerability DatabaseVERACODE:41940

HistoryAug 02, 2023 - 6:30 a.m.

Arbitrary Code Injection

2023-08-0206:30:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code injection

org.apache.nifi

custom code execution

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

66.3%

JSON

org.apache.nifi:* is vulnerable to Arbitrary Code Injection. The vulnerability exists in several functions which allows an authenticated attacker to submit a malicious request to configure a location that enables custom code execution.

CPENameOperatorVersion
nifi-cdc-mysql-processorsle1.22.0.2.4.5.0-6
nifi-apile1.22.0.2.4.5.0-6
nifi-jms-processorsle1.22.0.2.4.5.0-6
nifi-standard-processorsle1.22.0.2.4.5.0-6
nifi-dbcp-servicele1.22.0.2.4.5.0-6
nifi-hikari-dbcp-servicele1.22.0.2.4.5.0-6
nifi-hadoop-dbcp-servicele1.22.0.2.4.5.0-6
nifi-hbase_2-client-servicele1.22.0.2.4.5.0-6
nifi-record-serialization-servicesle1.22.0.2.4.5.0-6
nifi-cdc-mysql-processorsle1.22.0.2.4.5.0-6

Name	Operator	Version
nifi-cdc-mysql-processors	le	1.22.0.2.4.5.0-6
nifi-api	le	1.22.0.2.4.5.0-6
nifi-jms-processors	le	1.22.0.2.4.5.0-6
nifi-standard-processors	le	1.22.0.2.4.5.0-6
nifi-dbcp-service	le	1.22.0.2.4.5.0-6
nifi-hikari-dbcp-service	le	1.22.0.2.4.5.0-6
nifi-hadoop-dbcp-service	le	1.22.0.2.4.5.0-6
nifi-hbase_2-client-service	le	1.22.0.2.4.5.0-6
nifi-record-serialization-services	le	1.22.0.2.4.5.0-6
nifi-cdc-mysql-processors	le	1.22.0.2.4.5.0-6

Rows per page:

1-10 of 181

References

seclists.org/fulldisclosure/2023/Jul/43

www.openwall.com/lists/oss-security/2023/07/29/1

github.com/apache/nifi/commit/bdd7ef3671cfccf75e1fa1aaff867d2e35c68c85

github.com/apache/nifi/pull/7426

lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof

nifi.apache.org/security.html#CVE-2023-36542

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

66.3%

JSON

Related for VERACODE:41940