CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

2024-04-0916:05:32

CWE-94

apache

github.com

cve-2024-31864

apache zeppelin

remote code execution

jdbc connection string

vulnerability

mysql database

upgrade

version 0.11.1

security issue

AI Score

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache Zeppelin.

The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver.
This issue affects Apache Zeppelin: before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Zeppelin",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.11.1",
        "versionType": "semver"
      }
    ],
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "zeppelin",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.11.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]