Maven/org.apache.nifi:nifi-hikari-dbcp-service CVE-2023-34468: high 8.8, EPSS 61.87%
Apache NiFi vulnerable to Code Injection
Action: Upgrade org.apache.nifi:nifi-hikari-dbcp-service to 1.22.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.2 | 1.22.0 | - |
Fixed versions
| 1.22.0 |
Sources
- osv: GHSA-xm2m-2q6h-22jw#Maven/org.apache.nifi:nifi-hikari-dbcp-service
- https://nvd.nist.gov/vuln/detail/CVE-2023-34468
- https://github.com/apache/nifi/pull/7349
- https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361
- https://exceptionfactory.com/posts/2023/10/07/firsthand-analysis-of-apache-nifi-vulnerability-cve-2023-34468
- https://github.com/apache/nifi
- https://issues.apache.org/jira/browse/NIFI-11653
- https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8
- https://nifi.apache.org/security.html#CVE-2023-34468
- https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation
- http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/06/12/3
CVE-2023-34468 · published · modified · JSON