CyberRota Analysis
AI-GeneratedApache Zeppelin versions 0.6.0 to 0.12.0 are vulnerable to an LDAP injection flaw that allows authenticated attackers to manipulate LDAP search filters via the user-search endpoint, potentially exposing sensitive directory information. The vulnerability also impacts the role-lookup path following successful LDAP authentication. Organizations using affected versions should prioritize upgrading to version 0.12.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory information. The role-lookup path was also affected after successful LDAP authentication. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)