CVE-2026-44617

Katalog CVE

CVSS 6.5 · Medium EPSS 0,84%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada apache zeppelin. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped.                   This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

EPSS (30 hari)

0,84% peluang dieksploitasi; lebih tinggi dari 56,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/s65t6n3s1v4j5b1w7zvv5w73ko69m1zv mailing list · advisory vendor
• https://github.com/apache/zeppelin/pull/5226 issue tracking · patch
• https://www.cve.org/CVERecord?id=CVE-2024-31867 mailing list · advisory pihak ketiga