Lucene search

Veracode Vulnerability DatabaseVERACODE:46384

HistoryApr 12, 2024 - 11:39 a.m.

Code Injection

2024-04-1211:39:43

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache zeppelin

code injection

mysql

jdbc

security vulnerability

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Apache Zeppelin is vulnerable to a Code Injection. The vulnerability is due to improper verification of the JDBC driver configuration which allows an attacker to inject malicious code when connecting MySQL database.

CPENameOperatorVersion
zeppelin: jdbc interpreterle0.11.0
zeppelin: jdbc interpreterle0.11.0

CPE	Name	Operator	Version
	zeppelin: jdbc interpreter	le	0.11.0
	zeppelin: jdbc interpreter	le	0.11.0

References

www.openwall.com/lists/oss-security/2024/04/09/8

github.com/advisories/GHSA-66j8-c83m-gj5f

github.com/apache/zeppelin/commit/e65b5430e43c076c138a1f56e3f2aba1324118f2

github.com/apache/zeppelin/pull/4709

lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb

www.cve.org/CVERecord?id=CVE-2020-11974