Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-31864

Good to know:

icon
icon

Date: April 9, 2024

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Language: Java

Severity Score

Related Resources (9)

https://nvd.nist.gov/vuln/detail/CVE-2024-31864
https://github.com/apache/zeppelin/commit/e65b5430e43c076c138a1f56e3f2aba1324118f2
http://www.openwall.com/lists/oss-security/2024/04/09/8
https://github.com/apache/zeppelin
https://issues.apache.org/jira/browse/ZEPPELIN-5990
https://github.com/apache/zeppelin/pull/4709
https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb
https://www.cve.org/CVERecord?id=CVE-2020-11974
https://www.mend.io/vulnerability-database/CVE-2024-31864

Severity Score

Weakness Type (CWE)

Code Injection

CWE-94

Top Fix

icon

Upgrade Version

Upgrade to version org.apache.zeppelin:zeppelin-jdbc:0.11.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us