Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.4%
exploitation probability
2.4%top 17% of all CVEs
observed exploitation
nono source reports it
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Affected products
Apache Software Foundation · Apache NiFi