Vulnerability · Published Aug 3, 2025 · Assigned by apache

CVE-2024-52279Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string

High 7.5

In plain English

A high-severity improper input validation in Apache Zeppelin from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.1%top 33.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.zeppelin:zeppelin-jdbc	0.12.0	GHSA-jr43-q92q-5q82

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Zeppelin	0.11.1 – before 0.12.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/apache/zeppelin/pull/4838 patch
https://issues.apache.org/jira/browse/ZEPPELIN-6095 issue-tracking
https://www.cve.org/CVERecord?id=CVE-2024-31864 issue-tracking
https://lists.apache.org/thread/dxb98vgrb21rrl3k0fzonpk66onr6o4q vendor-advisory
http://www.openwall.com/lists/oss-security/2025/08/03/3