CVE-2023-34468

highpriority · attend · 67EPSS 0.619 · 99 %ileexploit · weaponizedDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

8 exploits · weaponized

Likely / severe?

61.9% (99th) EPSS

CVSS 8.8 · high

Is it mine?

9 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94USCWE-94US

exploits (8)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/apache_nifi_h2_rceApache NiFi H2 Connection String Remote Code Executionweaponized · metasploit
Jeanpt/CVE-2023-34468CVE-2023-34468 - Apache NiFi H2 RCE PoCPoC · poc_in_github
luiskrnr/HTB_Helix_CVE-2023-34468Writeup of the Hackthebox Helix machinePoC · poc_in_github
mbadanoiu/CVE-2023-34468CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFiPoC · poc_in_github
ozcanpng/CVE-2023-34468CVE-2023-34468 Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoCPoC · poc_in_github
sbouabid-sec/CVE-2023-34468-POCPoC exploit for CVE-2023-34468 — RCE via H2 RUNSCRIPT in Apache NiFi <= 1.21.0PoC · poc_in_github

affected products (9)

Products and version ranges known to be affected.

Apache Nifi <1.22.0all versionscert_bundDE
Apache Nifi< 1.22.0cert_bundDE
Apache Software Foundation Apache NiFi≤ 0.0.2 ≤1.21.0enisa_euvdEU
Apache Software Foundation NiFi0.0.2 → 1.22.0fstec_bduRU
apache nifi0.0.2 → 1.22.0nvdUScpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*
Bitnami nifi0.0.2 → 1.22.0osvUSpkg:bitnami/nifi
Maven org.apache.nifi:nifi-dbcp-base0.0.2 → 1.22.0osvUSpkg:maven/org.apache.nifi/nifi-dbcp-base
Maven org.apache.nifi:nifi-dbcp-service-nar0.0.2 → 1.22.0osvUSpkg:maven/org.apache.nifi/nifi-dbcp-service-nar
Maven org.apache.nifi:nifi-hikari-dbcp-service0.0.2 → 1.22.0osvUSpkg:maven/org.apache.nifi/nifi-hikari-dbcp-service

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-1423Apache Nifi: Mehrere SchwachstellenDeutsch2023-06-12csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Nifi ausnutzen, um beliebigen Programmcode auszuführen und weitere, nicht spezifizierte Auswirkungen zu erzielen.
GHSA-xm2m-2q6h-22jwApache NiFi vulnerable to Code Injection2023-06-12ghsa · osvUS
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
BIT-nifi-2023-34468Apache NiFi: Potential Code Injection with Database Services using H22025-09-12vendor · osvUS
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2023-06-12modified 2026-06-17

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan