CVE-2023-40037

Name: CVE-2023-40037
Creator: NVD / NIST
Published: 2023-08-18T22:15:10.69+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 1.52%

Last modified Jun 17, 2026

CVE-2023-40037 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. EPSS estimates a 1.52% chance of exploitation in the next 30 days.

Description

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

1.52%

71.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Apache	Nifi	>= 1.21.0, < 1.23.1

References

http://www.openwall.com/lists/oss-security/2023/08/18/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687qMailing List
https://nifi.apache.org/security.html#CVE-2023-40037Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/08/18/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687qMailing List
https://nifi.apache.org/security.html#CVE-2023-40037Vendor Advisory

Timeline

Published: Aug 18, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-40037?

How severe is CVE-2023-40037?

CVE-2023-40037 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 1.52% probability of exploitation in the next 30 days.

How do I fix CVE-2023-40037?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-40037?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST