Lucene search
Veracode Vulnerability DatabaseVERACODE:42873HistoryAug 22, 2023 - 3:43 a.m.
Insufficient URL Validation
2023-08-2203:43:52
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
insufficient url validation
authenticated attacker
privileges
connection url
unauthorized access
data resources
0.001 Low
EPSS
Percentile
42.7%
org.apache.nifi:nifi-dbcp-base is vulnerable to Insufficient URL Validation. The vulnerability allows an authenticated attacker with relevant privileges to bypass connection URL validation using custom input formatting, which leads to unauthorized access to data or other resources.
References
www.openwall.com/lists/oss-security/2023/08/18/2
github.com/advisories/GHSA-23qf-3jf9-h3q9
github.com/apache/nifi/commit/064550aacc189f39d7ddd2c0446068adf250f1bf
github.com/apache/nifi/pull/7586
issues.apache.org/jira/browse/NIFI-11920
lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687q
nifi.apache.org/security.html#CVE-2023-40037
Related
prion
prion
Design/Logic Flaw
2023-08-18 22:15:00
cvelist
cvelist
osv
osv
CVE-2023-40037
2023-08-18 22:15:10
Apache NiFi Insufficient Property Validation vulnerability
2023-08-19 00:30:29
github
github
Apache NiFi Insufficient Property Validation vulnerability
2023-08-19 00:30:29
cve
cve
CVE-2023-40037
2023-08-18 22:15:10