CVE-2024-31864
published 2024-04-09CVE-2024-31864: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code…
PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.26%
66.2th percentile
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver.
This issue affects Apache Zeppelin: before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zeppelin | < 0.11.1 | 0.11.1 |
| apache | zeppelin | >= 0.11.1 < 0.12.0 | 0.12.0 |
| apache_software_foundation | apache_zeppelin | >= 0.11.1 < 0.12.0 | 0.12.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
ghsa·2025-08-03·CVSS 9.8
CVE-2024-52279 [CRITICAL] CWE-20 Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
OSV
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
osv·2025-08-03·CVSS 9.8
CVE-2024-52279 [CRITICAL] Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
OSV
Apache Zeppelin remote code execution by adding malicious JDBC connection string
osv·2024-04-09
CVE-2024-31864 [CRITICAL] Apache Zeppelin remote code execution by adding malicious JDBC connection string
Apache Zeppelin remote code execution by adding malicious JDBC connection string
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
GHSA
Apache Zeppelin remote code execution by adding malicious JDBC connection string
ghsa·2024-04-09
CVE-2024-31864 [CRITICAL] CWE-94 Apache Zeppelin remote code execution by adding malicious JDBC connection string
Apache Zeppelin remote code execution by adding malicious JDBC connection string
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2024/04/09/8https://github.com/apache/zeppelin/pull/4709https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdbhttps://www.cve.org/CVERecord?id=CVE-2020-11974http://www.openwall.com/lists/oss-security/2024/04/09/8http://www.openwall.com/lists/oss-security/2025/08/03/3https://github.com/apache/zeppelin/pull/4709https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdbhttps://www.cve.org/CVERecord?id=CVE-2020-11974
2024-04-09
Published