Veracode Vulnerability DatabaseVERACODE:46390

HistoryApr 12, 2024 - 3:08 p.m.

Improper Input Validation

2024-04-1215:08:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache zeppelin

ldap

input validation

vulnerability

software

improper sanitization

malicious queries

AI Score

7.3

Confidence

High

EPSS

Percentile

15.5%

JSON

Apache Zeppelin is vulnerable to Improper Input Validation. The vulnerability is due to improper sanitization of LDAP search property configuration, which allows an attacker to execute malicious queries.

References

www.openwall.com/lists/oss-security/2024/04/09/12

github.com/advisories/GHSA-qmr3-52xf-wmhx

github.com/apache/zeppelin/commit/65d0bcc1ee8ec3ec372d0a71ab513cd20e6522a0

github.com/apache/zeppelin/pull/4714

lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf