CVE-2024-31864: Apache Zeppelin: Remote code execution by adding malicious JDBC connection string
First published: Tue Apr 09 2024(Updated: )
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.zeppelin:zeppelin-jdbc | <0.11.1 | 0.11.1 |
| Apache Zeppelin | <0.11.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2024-31864
- https://github.com/apache/zeppelin/pull/4709
- https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb
- https://www.cve.org/CVERecord?id=CVE-2020-11974
- https://github.com/apache/zeppelin/commit/e65b5430e43c076c138a1f56e3f2aba1324118f2
- https://issues.apache.org/jira/browse/ZEPPELIN-5990
- https://github.com/advisories/GHSA-66j8-c83m-gj5f (Advisory)
- http://www.openwall.com/lists/oss-security/2024/04/09/8
Frequently Asked Questions
What is the severity of CVE-2024-31864?
CVE-2024-31864 is considered a high-severity vulnerability due to its potential for code injection.
How do I fix CVE-2024-31864?
To mitigate CVE-2024-31864, upgrade Apache Zeppelin to version 0.11.1 or later.
What systems are affected by CVE-2024-31864?
CVE-2024-31864 affects Apache Zeppelin versions prior to 0.11.1 when connecting to MySQL databases via the JDBC driver.
What type of vulnerability is CVE-2024-31864?
CVE-2024-31864 is classified as an Improper Control of Generation of Code ('Code Injection') vulnerability.
What can attackers do with CVE-2024-31864?
Attackers exploiting CVE-2024-31864 can inject sensitive configurations or malicious code via JDBC connections.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-31864
- agent/title
- agent/first-publish-date
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/references
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-66j8-c83m-gj5f
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/tags
- agent/last-modified-date
- agent/description
- collector/nvd-api
- package-manager/maven
- vendor/apache
- canonical/apache zeppelin