CVE-2024-31864

moderate-risk
Published 2024-04-09

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Do I need to act?

-
0.85% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Apache

References (9)

Mailing List http://www.openwall.com/lists/oss-security/2024/04/09/8
Issue Tracking https://github.com/apache/zeppelin/pull/4709
Mailing List https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb
Not Applicable https://www.cve.org/CVERecord?id=CVE-2020-11974
Mailing List http://www.openwall.com/lists/oss-security/2024/04/09/8
http://www.openwall.com/lists/oss-security/2025/08/03/3
Issue Tracking https://github.com/apache/zeppelin/pull/4709
Mailing List https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb
Not Applicable https://www.cve.org/CVERecord?id=CVE-2020-11974
40
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 3/34 · Minimal
Exposure 5/34 · Minimal