CVE-2023-34212CWE-502

CVE-2023-34212: vulnerability in Apache NiFi

Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

Published · Updated

Follow this CVE+ Monitor Apache NiFi+ Monitor org.apache.nifi:nifi-jms-processors

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.4%
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Affected products
Apache Software Foundation · Apache NiFi
Related CVEs — Apache NiFi

In the same product, most dangerous first.

CVE-2023-34468HIGHApache NiFi: Potential Code Injection with Database Services using H2EPSS 61.9%CVE-2024-37389MEDIUMApache NiFi: Improper Neutralization of Input in Parameter Context DescriptionEPSS 24.0%CVE-2017-15697—CVE-2017-15697EPSS 4.8%CVE-2018-1309—CVE-2018-1309EPSS 4.4%CVE-2020-1928—CVE-2020-1928EPSS 4.0%CVE-2017-5636—CVE-2017-5636EPSS 3.6%