CVEvulnerability
CVE-2024-31864
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2024-04-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver.
This issue affects Apache Zeppelin: before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Affected configurations
• apache zeppelin (< 0.11.1)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://www.openwall.com/lists/oss-security/2024/04/09/8 Mailing List
- https://github.com/apache/zeppelin/pull/4709 Issue Tracking
- https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb Mailing List, Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-11974 Not Applicable
- http://www.openwall.com/lists/oss-security/2024/04/09/8 Mailing List
- http://www.openwall.com/lists/oss-security/2025/08/03/3 www.openwall.com
- https://github.com/apache/zeppelin/pull/4709 Issue Tracking
- https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb Mailing List, Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-11974 Not Applicable