Apache NiFi

7 results · Clear filters · Feed

• High 7.5
  CVE-2026-39816 Public exploit

  Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService

  The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Scri…

  Apache Software Foundation Apache NiFi org.apache.nifi:nifi-other-graph-services-nar Maven
  May 8, 2026
• Low 2.1
  CVE-2024-56512 Public exploit

  Apache NiFi: Missing Complete Authorization for Parameter and Service References

  Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to …

  Apache Software Foundation Apache NiFi org.apache.nifi:nifi-web-api Maven
  Dec 28, 2024
• Medium 6.5
  CVE-2023-40037 Public exploit

  Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

  Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass…

  Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jms-processors org.apache.nifi:nifi-dbcp-base Maven
  Aug 18, 2023
• High 8.8
  CVE-2023-36542 Public exploit

  Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources

  Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution i…

  Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jms-processors org.apache.nifi:nifi-standard-processors Maven
  Jul 29, 2023
• Medium 6.5
  CVE-2023-34212 Public exploit

  Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

  The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of…

  Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jms-processors Maven
  Jun 12, 2023
• High 8.8
  CVE-2023-34468 Public exploit EPSS 62%

  Apache NiFi: Potential Code Injection with Database Services using H2

  The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates th…

  Apache Software Foundation Apache NiFi org.apache.nifi:nifi-dbcp-base org.apache.nifi:nifi-hikari-dbcp-service Maven
  Jun 12, 2023
• High 8.8
  CVE-2022-33140 Public exploit

  Improper Neutralization of Command Elements in Shell User Group Provider

  The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUs…

  Apache Software Foundation Apache NiFi Apache NiFi Registry org.apache.nifi:nifi Maven
  Jun 15, 2022