CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-31864: Apache Zeppelin: Remote code execution by adding malicious JDBC connection string
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver.
This issue affects Apache Zeppelin: before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Classification
CVE ID: CVE-2024-31864
Affected Products
Vendor: Apache Software Foundation
Product: Apache Zeppelin
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 18.39% (scored less or equal to compared to others)
EPSS Date: 2025-03-14 (when was this score calculated)
References
https://github.com/apache/zeppelin/pull/4709https://www.cve.org/CVERecord?id=CVE-2020-11974
https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb
http://www.openwall.com/lists/oss-security/2024/04/09/8