Paper/Archive/CVE-2024-31864

CVE-2024-31864

Apache Software Foundation Apache Zeppelin — Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 69.6.696 × 2013.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Zeppelin< 0.11.10.11.1CNA

zeppelin< 0.11.10.11.1CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/apache/zeppelin/pull/4709 refcve.org/CVERecord?id=CVE-2020-11974 advisorylists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb refopenwall.com/lists/oss-security/2024/04/09/8 refopenwall.com/lists/oss-security/2025/08/03/3