GitHub Advisoryadvisory · Maven

GHSA-qmr3-52xf-wmhx Apache Zeppelin: LDAP search filter query Injection Vulnerability

MEDIUM Published 2024-04-09 Modified 2024-05-02 Official page ↗
Aliases
CVE-2024-31867
Ecosystem
Maven
Packages
org.apache.zeppelin:zeppelin-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-90
Reviewed
2024-04-10

Affected packages

• Maven org.apache.zeppelin:zeppelin-server: >= 0.8.2, < 0.11.1 → fixed in 0.11.1

Description

Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-31867 Improper Input Validation vulnerability in Apache Zeppelin. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query weakness

References