CVE-2023-34468

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

• CWE-94

• http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2023/06/12/3Mailing List, Third Party Advisory
• https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8Mailing List, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2023-34468Release Notes, Vendor Advisory
• https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation/Third Party Advisory
• http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2023/06/12/3Mailing List, Third Party Advisory
• https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8Mailing List, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2023-34468Release Notes, Vendor Advisory
• https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation/Third Party Advisory

Published

Jun 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34462Netty is an asynchronous event-driven network application fr…6.5
• CVE-2023-34463DataEase is an open source data visualization analysis tool …8.1
• CVE-2023-34464XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2023-34465XWiki Platform is a generic wiki platform. Starting in versi…8.1
• CVE-2023-34466XWiki Platform is a generic wiki platform offering runtime s…4.3
• CVE-2023-34467XWiki Platform is a generic wiki platform. Starting in versi…7.5
• CVE-2023-34469 AMI AptioV contains a vulnerability in BIOS where an Attack…4.6
• CVE-2023-3447The Active Directory Integration / LDAP Integration plugin f…7.6
• CVE-2023-34470 AMI AptioV contains a vulnerability in BIOS where an Attack…7.8
• CVE-2023-34471 AMI SPx contains a vulnerability in the BMC where a user m…8.1
• CVE-2023-34472AMI SPx contains a vulnerability in the BMC where an Attacke…6.5
• CVE-2023-34473 AMI SPx contains a vulnerability in the BMC where a valid u…8.8