Lucene search

ApacheCVE-2023-36542

HistoryJul 29, 2023 - 8:15 a.m.

CVE-2023-36542

2023-07-2908:15:48

CWE-94

apache

web.nvd.nist.gov

apache nifi

cve-2023-36542

remote code execution

http url

upgrade

security mitigation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.008

Percentile

82.2%

JSON

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

Affected configurations

Nvd

Vulners

Node

apachenifiRange0.0.2–1.22.0

VendorProductVersionCPE
apachenifi*cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	nifi	*	cpe:2.3:a:apache:nifi::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache NiFi",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.22.0",
        "status": "affected",
        "version": "0.0.2",
        "versionType": "semver"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2023/Jul/43

www.openwall.com/lists/oss-security/2023/07/29/1

lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof

nifi.apache.org/security.html#CVE-2023-36542

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.008

Percentile

82.2%

JSON

Related for CVE-2023-36542