Package · Maven

org.apache.nifi:nifi-dbcp-base

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Medium 6.5

CVE-2023-40037 Public exploit

Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass…

Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jms-processors org.apache.nifi:nifi-dbcp-base Maven

Aug 18, 2023
High 8.8

CVE-2023-34468 Public exploit EPSS 62%

Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates th…

Apache Software Foundation Apache NiFi org.apache.nifi:nifi-hikari-dbcp-service org.apache.nifi:nifi-dbcp-base Maven

Jun 12, 2023