CVE-2023-36542

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Jul 29, 2023
Updated: Aug 3, 2023
CWE ID 94

Summary

CVE-2023-36542 is a vulnerability affecting Apache NiFi versions 0.0.2 through 1.22.0. It allows authenticated and authorized users to configure locations that enable custom code execution in Processors and Controller Services, which support HTTP URL references for retrieving drivers. The vulnerability can be exploited to execute arbitrary code. To mitigate this risk, a new Required Permission for referencing remote resources has been introduced. This permission restricts configuration of these components to privileged users, preventing unprivileged users from making changes. Upgrading to Apache NiFi 1.23.0 is the recommended solution for addressing this vulnerability.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Apache NiFi

Affected Vendors

  • Apache Software Foundation