CVE-2023-36542 — HIGH (8.8)

Q: How severe is CVE-2023-36542?

CVE-2023-36542 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2023-36542?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Nifi.

Vulnerability Description

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Apache	Nifi	>= 0.0.2, <= 1.22.0

Related Weaknesses (CWE)

CWE-94

References

http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
http://www.openwall.com/lists/oss-security/2023/07/29/1Mailing ListThird Party Advisory
https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbofIssue TrackingMailing ListVendor Advisory
https://nifi.apache.org/security.html#CVE-2023-36542Vendor Advisory
http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
http://www.openwall.com/lists/oss-security/2023/07/29/1Mailing ListThird Party Advisory
https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbofIssue TrackingMailing ListVendor Advisory
https://nifi.apache.org/security.html#CVE-2023-36542Vendor Advisory

FAQ

What is CVE-2023-36542?

CVE-2023-36542 is a vulnerability with a CVSS score of 8.8 (HIGH). Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a lo...

How severe is CVE-2023-36542?

CVE-2023-36542 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-36542?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Nifi.