VulnerabilityModified
CVE-2024-31864
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
CRITICAL 9.8EPSS 1.26%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.26% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- apache/zeppelin
- Source
- security@apache.org
References
- http://www.openwall.com/lists/oss-security/2024/04/09/8Mailing List
- https://github.com/apache/zeppelin/pull/4709Issue Tracking
- https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdbMailing List, Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-11974Not Applicable
- http://www.openwall.com/lists/oss-security/2024/04/09/8Mailing List
- http://www.openwall.com/lists/oss-security/2025/08/03/3
- https://github.com/apache/zeppelin/pull/4709Issue Tracking
- https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdbMailing List, Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-11974Not Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.