CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

2024-04-0916:05:32

CWE-94

apache

www.cve.org

cve-2024-31864

apache zeppelin

code injection

jdbc connection

mysql database

upgrade

9.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache Zeppelin.

The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver.
This issue affects Apache Zeppelin: before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "product": "Apache Zeppelin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "0.11.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]