CVE-2024-49194

Summary

CVE-2024-49194 is a remote code execution (RCE) vulnerability affecting the Databricks JDBC Driver before version 2.6.40. This issue arises due to the driver's mishandling of the krbJAASFile parameter in JDBC URLs. An attacker could exploit this vulnerability by crafting a connection URL containing a malicious JNDI injection, which may result in RCE in the context of the driver. This flaw poses a significant risk, as it allows an attacker to execute arbitrary code on affected systems.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.