CVE-2024-31864

Apache Zeppelin is vulnerable to a Code Injection vulnerability (CWE-94) due to improper validation of the JDBC driver configuration. An attacker can inject sensitive configuration or malicious code when connecting to a MySQL database via a JDBC driver because the application fails to properly fi...

CVE-2024-31866

Apache Zeppelin is vulnerable to a Code Injection (CWE-116) flaw due to improper handling of configuration overrides, specifically ZEPPELIN_INTP_CLASSPATH_OVERRIDES . Attackers can exploit this by overriding environment variables to execute shell scripts or inject malicious code . This vulnerabil...