asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi Status Resources Contacts !Track Issueshttps://img...

org.apache.nifi.minifi:minifi-assembly (1.22.0), org.apache.nifi:nifi-record-serialization-services-nar (>=1.2.0, <=1.22.0) +6 more potentially affected by CVE-2023-36542 via org.apache.nifi:nifi-record-serialization-services (>=1.2.0, <=1.22.0)

org.apache.nifi:nifi-record-serialization-services MAVEN version =1.2.0, =1.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.2, =0.2.3 Source cves: CVE-2023-36542 Source advisory: GHSA-R969-8V3H-23V9...

org.apache.nifi.minifi:minifi-assembly (1.22.0), org.apache.nifi:nifi-record-serialization-services-nar (>=1.2.0, <=1.22.0) +6 more potentially affected by CVE-2023-36542 via org.apache.nifi:nifi-record-serialization-services (>=1.2.0, <=1.22.0)

org.apache.nifi:nifi-record-serialization-services MAVEN version =1.2.0, =1.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.2, =0.2.3 Source cves: CVE-2023-36542 Source advisory: OSV:GHSA-R969-8V3H-23V9...

com.hcl.commerce:commerce-search-processors (>=9.1.12.0, <=9.1.15.0), org.apache.nifi.minifi:minifi-assembly (>=1.14.0, <=1.22.0) +7 more potentially affected by CVE-2023-36542 via org.apache.nifi:nifi-standard-processors (>=0.0.2-incubating, <=1.22.0)

org.apache.nifi:nifi-standard-processors MAVEN version =0.0.2-incubating, =9.1.12.0, =1.14.0, =1.14.0, =1.14.0, =0.0.2-incubating, =1.15.0, =1.14.0, =1.22.0 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-36542 Source...

CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

CVE-2023-36542

Apache NiFi versions 0.0.2 through 1.22.0 are vulnerable to a code injection flaw because certain Processors and Controller Services support HTTP URL references for retrieving drivers. An authenticated and authorized user can exploit this by configuring a location that enables custom code executi...