CVE-2023-34212

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.

The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache NiFi	>= 1.8.0, <= 1.21.0

References

http://www.openwall.com/lists/oss-security/2023/06/12/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5Mailing List, Vendor Advisory
https://nifi.apache.org/security.html#CVE-2023-34212Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/06/12/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5Mailing List, Vendor Advisory
https://nifi.apache.org/security.html#CVE-2023-34212Release Notes, Vendor Advisory

Timeline

Published: Jun 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-342139.8TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficien CVE-2023-342149.8TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injectio CVE-2023-342159.8TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insuffi CVE-2023-342168.1TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injectio CVE-2023-342178.1TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injectio CVE-2023-342189.8In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible CVE-2023-342194.3In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration se CVE-2023-34228.8Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extens CVE-2023-342205.4In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible CVE-2023-342215.4In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible CVE-2023-342226.1In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible CVE-2023-342235.3In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases