CVE-2023-34468

CVSS 3.1: 8.8 high
EPSS: 62%p99
Published: Jun 12, 2023 · Jun 12, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-34468 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Vendors: apache

Products: nifi

Weakness: CWE-94

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (61.9%)

In the news

1 story

OpenRefine's Zip Slip Vulnerability Could Let Attackers Execute Malicious Code

The Hacker NewsOct 2, 08:02 UTC · Oct 2, 2023VulnerabilityCVE-2023-37476 CVE-2023-29357 CVE-2023-24955+12 · 1 read