CVE-2024-31864

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.

The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Zeppelin	< 0.11.1
apache	zeppelin	< 0.11.1

References

http://www.openwall.com/lists/oss-security/2024/04/09/8Mailing List
https://github.com/apache/zeppelin/pull/4709Issue Tracking
https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdbMailing List, Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2020-11974Not Applicable
http://www.openwall.com/lists/oss-security/2024/04/09/8Mailing List
http://www.openwall.com/lists/oss-security/2025/08/03/3
https://github.com/apache/zeppelin/pull/4709Issue Tracking
https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdbMailing List, Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2020-11974Not Applicable

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-318656.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so CVE-2024-318669.8Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by over CVE-2024-318676.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration p CVE-2024-318686.1Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to CVE-2024-318694.3Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the CVE-2024-31875.9This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are cause CVE-2024-318703.3IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacke CVE-2024-318718.1IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deployin CVE-2024-318728.1IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deployin CVE-2024-318737.5IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication CVE-2024-318745.5IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to caus CVE-2024-318785.3IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can