CVE-2024-31866

2024-04-0916:15:08

CWE-116

[email protected]

web.nvd.nist.gov

cve-2024-31866

apache zeppelin

shell scripts

code execution

configuration override

upgrade

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected configurations

Vulners

Node

apachezeppelinRange≤0.11.1

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.zeppelin:zeppelin-interpreter",
    "product": "Apache Zeppelin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "0.11.1",
        "status": "affected",
        "version": "0.8.2",
        "versionType": "semver"
      }
    ]
  }
]