Every CVE Search/ Get API key

CVE-2023-34468

Apache NiFi: Potential Code Injection with Database Services using H2

8.8 HighPublic exploitFix available

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

61.9%Up 61.8 points since Jun 13, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Record
CVE-2023-34468
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
CVE List 8.8

Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Record
CVE-2023-34468
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2023-1917 8.8

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Record
EUVD-2023-1917
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-xm2m-2q6h-22jw 8.8

Apache NiFi vulnerable to Code Injection

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Record
GHSA-xm2m-2q6h-22jw
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 8.8

Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Record
CVE-2023-34468
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-xm2m-2q6h-22jw 8.8

Apache NiFi vulnerable to Code Injection

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Record
GHSA-xm2m-2q6h-22jw
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVBIT-nifi-2023-34468 No score

Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Record
BIT-nifi-2023-34468
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.nifi:nifi-dbcp-base
Maven
 0.0.2 up to 1.22.0
1.22.0
org.apache.nifi:nifi-hikari-dbcp-service
Maven
 0.0.2 up to 1.22.0
1.22.0
org.apache.nifi:nifi-dbcp-service-nar
Maven
 0.0.2 up to 1.22.0
1.22.0
nifi
Bitnami
 0.0.2 up to 1.22.0
1.22.0
org.apache.nifi:nifi-dbcp-base
Maven
 0.0.2 up to 1.22.0, plus listed versions
1.19.01.19.11.20.01.21.0
1.22.0
org.apache.nifi:nifi-hikari-dbcp-service
Maven
 0.0.2 up to 1.22.0, plus listed versions
1.16.01.16.11.16.21.16.31.17.0
Show 5 moreShow less
1.18.01.19.01.19.11.20.01.21.0
1.22.0
org.apache.nifi:nifi-dbcp-service-nar
Maven
 0.0.2 up to 1.22.0, plus listed versions
0.2.0-incubating0.2.10.3.00.4.00.4.1
Show 45 moreShow less
0.5.00.5.10.6.00.6.10.7.00.7.10.7.20.7.30.7.41.0.01.0.0-BETA1.0.11.1.01.1.11.1.21.10.01.11.01.11.11.11.21.11.31.11.41.12.01.12.11.13.01.13.11.13.21.14.01.15.01.15.11.15.21.15.31.16.01.16.11.16.21.16.31.17.01.18.01.19.01.19.11.2.01.20.01.21.01.3.01.4.01.5.0
1.22.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache NiFi H2 Connection String Remote Code Execution2023-06-12
PoC in GitHubJeanpt/CVE-2023-344682026-05-10
PoC in GitHubluiskrnr/HTB_Helix_CVE-2023-344682026-09-09
PoC in GitHubmbadanoiu/CVE-2023-344682023-11-25
PoC in GitHubozcanpng/CVE-2023-344682026-07-12
PoC in GitHubsbouabid-sec/CVE-2023-34468-POC2026-05-10
PoC in GitHubshoucheng3/asf__nifi_CVE-2023-34468_1-21-002025-08-18
PoC in GitHubspikeyjr/CVE-2023-34468-PoC2026-06-16

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-34468 is a high vulnerability (CVSS 8.8) in Apache Nifi, published June 12, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 61.9%, the 99th percentile. Fixed in org.apache.nifi:nifi-dbcp-base 1.22.0.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 7 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open