CVE-2024-31867

2024-04-0917:16:03

CWE-20

apache

web.nvd.nist.gov

improper input validation

apache zeppelin

ldap search filter

security vulnerability

cve-2024-31867

upgrade

AI Score

6.8

Confidence

High

EPSS

Percentile

15.5%

JSON

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected configurations

Vulners

Node

apachezeppelinRange≤0.11.1

VendorProductVersionCPE
apachezeppelin*cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	zeppelin	*	cpe:2.3:a:apache:zeppelin::::::::

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.zeppelin:zeppelin-server",
    "product": "Apache Zeppelin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "0.11.1",
        "status": "affected",
        "version": "0.8.2",
        "versionType": "semver"
      }
    ]
  }
]