CVE-2023-34212
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors in Apache NiFi versions 1.8.0 through 1.21.0, allows an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
Risk Assessment
The ability to deserialize untrusted data may lead to serious security vulnerabilities, including remote code execution, posing a threat to the integrity of the system.
Recommendation
It is recommended to upgrade to version 1.22.0 or later, which addresses this issue by validating the JNDI URL and restricting locations to a set of allowed schemes.
Original NVD description (English source)
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.