CVE-2024-31864
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
| Software | From | Fixed in |
|---|---|---|
org.apache.zeppelin / zeppelin-jdbc
|
- | 0.11.1 |
| apache / zeppelin | - | 0.11.1 |
- http://www.openwall.com/lists/oss-security/2024/04/09/8
- http://www.openwall.com/lists/oss-security/2025/08/03/3
- https://github.com/apache/zeppelin/commit/e65b5430e43c076c138a1f56e3f2aba1324118f2
- https://github.com/apache/zeppelin/pull/4709
- https://issues.apache.org/jira/browse/ZEPPELIN-5990
- https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb
- https://www.cve.org/CVERecord?id=CVE-2020-11974
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime