Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xbXIzLTUyeGYtd21oeM4AA6yr

Apache Zeppelin: LDAP search filter query Injection Vulnerability

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Permalink: https://github.com/advisories/GHSA-qmr3-52xf-wmhx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xbXIzLTUyeGYtd21oeM4AA6yr
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 months ago
Updated: 9 months ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00045
EPSS Percentile: 0.17541

Identifiers: GHSA-qmr3-52xf-wmhx, CVE-2024-31867
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-31867
• https://github.com/apache/zeppelin/pull/4714
• https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf
• https://github.com/apache/zeppelin/commit/65d0bcc1ee8ec3ec372d0a71ab513cd20e6522a0
• http://www.openwall.com/lists/oss-security/2024/04/09/12
• https://github.com/advisories/GHSA-qmr3-52xf-wmhx

Repository: https://github.com/apache/zeppelin
Blast Radius: 10.2

Affected Packages