CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

• CWE-94

• http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
• http://www.openwall.com/lists/oss-security/2023/07/29/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbofIssue Tracking, Mailing List, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2023-36542Vendor Advisory
• http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
• http://www.openwall.com/lists/oss-security/2023/07/29/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbofIssue Tracking, Mailing List, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2023-36542Vendor Advisory

Published

Jul 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36537Improper privilege management in Zoom Rooms for Windows befo…7.8
• CVE-2023-36538Improper access control in Zoom Rooms for Windows before ver…7.8
• CVE-2023-36539Exposure of information intended to be encrypted by some Zoo…7.5
• CVE-2023-3654cashIT! - serving solutions. Devices from "PoS/ Dienstleistu…9.8
• CVE-2023-36540Untrusted search path in the installer for Zoom Desktop Clie…7.8
• CVE-2023-36541Insufficient verification of data authenticity in Zoom Deskt…8.8
• CVE-2023-36543Apache Airflow, versions before 2.6.3, has a vulnerability w…6.5
• CVE-2023-36546Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-36547A improper neutralization of special elements used in an os …9.8
• CVE-2023-36548A improper neutralization of special elements used in an os …9.8
• CVE-2023-36549A improper neutralization of special elements used in an os …9.8
• CVE-2023-3655cashIT! - serving solutions. Devices from "PoS/ Dienstleistu…7.5