CVE-2024-31867

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Zeppelin	>= 0.8.2, < 0.11.1

References

http://www.openwall.com/lists/oss-security/2024/04/09/12Mailing List
https://github.com/apache/zeppelin/pull/4714Issue Tracking, Patch
https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtfMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/09/12Mailing List
https://github.com/apache/zeppelin/pull/4714Issue Tracking, Patch
https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtfMailing List, Vendor Advisory

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-318686.1Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to CVE-2024-318694.3Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the CVE-2024-31875.9This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are cause CVE-2024-318703.3IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacke CVE-2024-318718.1IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deployin CVE-2024-318728.1IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deployin CVE-2024-318737.5IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication CVE-2024-318745.5IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to caus CVE-2024-318785.3IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can CVE-2024-318797.5IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the syste CVE-2024-31886.3The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes b CVE-2024-318806.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific