Design/Logic Flaw

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2023-34212

Affected software: Apache NiFi (versions 1.8.0–1.21.0). Vulnerability: The JndiJmsConnectionFactoryProvider Controller Service, with ConsumeJMS and PublishJMS Processors, allows an authenticated/authorized user to configure URL and library properties that enable deserialization of untrusted data ...

CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

CVE-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

CVE-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

PT-2023-5586 · Apache · Apache Nifi

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 0.0.2 through 1.21.0 Description: The issue in Apache NiFi is related to the DBCPConnectionPool and HikariCPConnectionPool Controller Services, which allow an authenticated and authorized user to configure a Database URL...

Apache NiFi 代码注入漏洞

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A code injection vulnerability exists in Apache NiFi versions 0.0.2 through 1.21.0 that originates from allowing...

PT-2023-24742 · Apache · Apache Nifi

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.8.0 through 1.21.0 Description: The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, allow an authenticated and authorized user to configure URL and library...

Apache NiFi Login Scanner

This module attempts to take login details for Apache NiFi websites and identify if they are valid or not. Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 Also works against NiFi use auxiliary/scanner/http/apachenifilogin msf auxiliaryapachenifilogin show actions ...actions... msf...

Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining

A financially motivated threat actor is actively scouring the internet for unprotected Apache NiFi instances to covertly install a cryptocurrency miner and facilitate lateral movement. The findings come from the SANS Internet Storm Center ISC, which detected a spike in HTTP requests for "/nifi" o...

Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining

A financially motivated threat actor is actively scouring the internet for unprotected Apache NiFi instances to covertly install a cryptocurrency miner and facilitate lateral movement. The findings come from the SANS Internet Storm Center ISC, which detected a spike in HTTP requests for "/nifi" o...

Apache NiFi Version Scanner

This module identifies Apache NiFi websites and reports their version number. Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0 Also works against NiFi use auxiliary/scanner/http/apachenifiversion msf auxiliaryapachenifiversion show actions ...actions... msf...

GHSA-3X8X-79M2-3W2W vulnerabilities

Vulnerabilities for packages: scala, cassandra-reaper, management-api-for-apache-cassandra-5.0...

GHSA-3X8X-79M2-3W2W vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, cassandra-reaper, scala, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1...

CVE-2021-46877 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, cassandra-reaper, scala, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1...

CVE-2021-46877 vulnerabilities

Vulnerabilities for packages: scala, cassandra-reaper, management-api-for-apache-cassandra-5.0...

Apache NiFi XML External Entity Injection Vulnerability (CNVD-2023-23555)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. An XML external entity injection vulnerability exists in Apache NiFi versions 1.2.0 through 1.19.1, which stems fro...