PT-2025-31783 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.11.1 through 0.12.0 Description: An improper input validation issue exists in Apache Zeppelin. The fix for JDBC URL validation did not account for URL encoded input. Recommendations: Upgrade to version 0.12.0...

CVE-2024-31864

creationtimestamp| type| source ---|---|--- 2024-04-13 00:29:02+00:00| seen| https://t.me/arpsyndicate/4610 2025-08-03 10:45:41+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lviiseg7vlq2 2025-08-03 14:03:12+00:00| seen|...

CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...

CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...

CVE-2024-31864

CVE-2024-31864 affects Apache Zeppelin prior to 0.11.1, enabling code injection when establishing a MySQL JDBC connection. The issue is described as improper control of generation of code, with a CVSS v3.1 base score of 9.8 (Network, HIGH impact on confidentiality, integrity, and availability). T...