CVE-2024-31866 Apache Zeppelin: Interpreter download command does not escape malicious code injection

2024-04-0916:09:12

CWE-116

apache

www.cve.org

apache zeppelin

shell scripts

configuration override

security issue

upgrade

AI Score

7.2

Confidence

High

EPSS

Percentile

15.5%

JSON

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.zeppelin:zeppelin-interpreter",
    "product": "Apache Zeppelin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "0.11.1",
        "status": "affected",
        "version": "0.8.2",
        "versionType": "semver"
      }
    ]
  }
]