CVE-2023-34468
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi versions 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized code execution on the system, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade to version 1.22.0 or later, which fixes this issue.
Original NVD description (English source)
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.