GHSA-qmr3-52xf-wmhx

Source

https://github.com/advisories/GHSA-qmr3-52xf-wmhx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-qmr3-52xf-wmhx/GHSA-qmr3-52xf-wmhx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qmr3-52xf-wmhx

Aliases

CVE-2024-31867

Published

2024-04-09T18:30:28Z

Modified

2024-05-02T15:12:50Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Apache Zeppelin: LDAP search filter query Injection Vulnerability

Details

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-20",
        "CWE-90"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-10T22:00:52Z",
    "nvd_published_at":  "2024-04-09T17:16:03Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.apache.zeppelin:zeppelin-server

Package

Name: org.apache.zeppelin:zeppelin-server; View open source insights on deps.dev
Purl: pkg:maven/org.apache.zeppelin/zeppelin-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.8.2

Fixed

0.11.1

Affected versions

0.*

0.8.2

0.9.0

0.9.0-preview1

0.9.0-preview2

0.10.0

0.10.1

0.11.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-qmr3-52xf-wmhx/GHSA-qmr3-52xf-wmhx.json"