Lucene search

GitHub Advisory DatabaseGHSA-QMR3-52XF-WMHX

HistoryApr 09, 2024 - 6:30 p.m.

Apache Zeppelin: LDAP search filter query Injection Vulnerability

2024-04-0918:30:28

CWE-20

CWE-90

GitHub Advisory Database

github.com

apache zeppelin

ldap search filter

input validation

vulnerability

attackers

configuration

upgrade

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected configurations

Vulners

Node

org.apache.zeppelinzeppelin-serverRange0.8.2–0.11.1

VendorProductVersionCPE
org.apache.zeppelinzeppelin-server*cpe:2.3:a:org.apache.zeppelin:zeppelin-server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.apache.zeppelin	zeppelin-server	*	cpe:2.3:a:org.apache.zeppelin:zeppelin-server::::::::

References

www.openwall.com/lists/oss-security/2024/04/09/12

github.com/advisories/GHSA-qmr3-52xf-wmhx

github.com/apache/zeppelin/commit/65d0bcc1ee8ec3ec372d0a71ab513cd20e6522a0

github.com/apache/zeppelin/pull/4714

lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf

nvd.nist.gov/vuln/detail/CVE-2024-31867