CVE-2023-40037
Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
- Record
CVE-2023-40037- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-184, CWE-697
- Updated
- 2026-11-02
CVE List No score
Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
- Record
CVE-2023-40037- Weakness
- CWE-184
- Updated
- 2026-11-02
EUVDEUVD-2023-2181
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
- Record
EUVD-2023-2181- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23qf-3jf9-h3q9
Apache NiFi Insufficient Property Validation vulnerability
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
- Record
GHSA-23qf-3jf9-h3q9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-184, CWE-697
- Updated
- 2026-11-02
OSVGHSA-23qf-3jf9-h3q9
Apache NiFi Insufficient Property Validation vulnerability
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
- Record
GHSA-23qf-3jf9-h3q9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-184, CWE-697
- Updated
- 2026-11-02
OSVBIT-nifi-2023-40037 No score
Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
- Record
BIT-nifi-2023-40037- Updated
- 2026-11-02
OSV No score
Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
- Record
CVE-2023-40037- Weakness
- CWE-184
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.nifi:nifi-dbcp-baseMaven |
1.21.0 up to 1.23.1 | 1.23.1 |
org.apache.nifi:nifi-jms-processorsMaven |
1.21.0 up to 1.23.1 | 1.23.1 |
org.apache.nifi:nifi-dbcp-service-apiMaven |
1.21.0 up to 1.23.1 | 1.23.1 |
org.apache.nifi:nifi-dbcp-service-bundleMaven |
1.21.0 up to 1.23.1 | 1.23.1 |
nifiBitnami |
1.21.0 up to 1.23.1 | 1.23.1 |
org.apache.nifi:nifi-dbcp-baseMaven |
1.21.0 up to 1.23.1, plus listed versions 1.22.01.23.0 |
1.23.1 |
org.apache.nifi:nifi-jms-processorsMaven |
1.21.0 up to 1.23.1, plus listed versions 1.22.01.23.0 |
1.23.1 |
org.apache.nifi:nifi-dbcp-service-apiMaven |
1.21.0 up to 1.23.1, plus listed versions 1.22.01.23.0 |
1.23.1 |
org.apache.nifi:nifi-dbcp-service-bundleMaven |
1.21.0 up to 1.23.1, plus listed versions 1.22.01.23.0 |
1.23.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mbadanoiu/CVE-2023-40037 | 2023-11-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-40037 is a medium vulnerability (CVSS 6.5) in Apache Nifi, published August 18, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in org.apache.nifi:nifi-dbcp-base 1.23.1.