CVE-2023-40037

Summary

CVE-2023-40037 affects Apache NiFi versions 1.21.0 through 1.23.0, where JDBC and JNDI JMS access in certain Processors and Controller Services feature inadequate connection URL validation. An authenticated and authorized user is able to bypass this validation using crafted input formatting. The vulnerability is resolved by enhancing connection URL validation and introducing additional property validation in Apache NiFi 1.23.1. Upgrading to this version is the recommended mitigation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.