CVE-2023-40037

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.

• CWE-184
• CWE-697

• http://www.openwall.com/lists/oss-security/2023/08/18/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687qMailing List
• https://nifi.apache.org/security.html#CVE-2023-40037Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/08/18/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687qMailing List
• https://nifi.apache.org/security.html#CVE-2023-40037Vendor Advisory

Published

Aug 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40031Notepad++ is a free and open-source source code editor. Vers…7.8
• CVE-2023-40032libvips is a demand-driven, horizontally threaded image proc…5.5
• CVE-2023-40033Flarum is an open source forum software. Flarum is affected …7.1
• CVE-2023-40034Woodpecker is a community fork of the Drone CI system. In af…8.1
• CVE-2023-40035Craft is a CMS for creating custom digital experiences on th…7.2
• CVE-2023-40036Notepad++ is a free and open-source source code editor. Vers…5.5
• CVE-2023-40038Arris DG860A and DG1670A devices have predictable default WP…8.8
• CVE-2023-40039An issue was discovered on ARRIS TG852G, TG862G, and TG1672G…9.8
• CVE-2023-4004A use-after-free flaw was found in the Linux kernel's netfil…7.8
• CVE-2023-40040An issue was discovered in the MyCrops HiGrade "THC Testing …5.3
• CVE-2023-40041TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer…9.8
• CVE-2023-40042TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer…9.8