Lucene search

GitHub Advisory DatabaseGHSA-86JX-WR74-XR74

HistoryApr 09, 2024 - 6:30 p.m.

Improper escaping in Apache Zeppelin

2024-04-0918:30:22

CWE-116

GitHub Advisory Database

github.com

apache zeppelin

improper encoding

vulnerability

upgrade

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

JSON

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected configurations

Vulners

Node

org.apache.zeppelin\zeppelinMatchinterpreter

CPENameOperatorVersion
org.apache.zeppelin:zeppelin-interpreterlt0.11.1

CPE	Name	Operator	Version
	org.apache.zeppelin:zeppelin-interpreter	lt	0.11.1

References

www.openwall.com/lists/oss-security/2024/04/09/10

github.com/advisories/GHSA-86jx-wr74-xr74

github.com/apache/zeppelin/commit/dd08a3966ef3b0b40f13d0291d7cac5ec3dd9f9c

github.com/apache/zeppelin/pull/4715

lists.apache.org/thread/jpkbq3oktopt34x2n5wnhzc2r1410ddd

nvd.nist.gov/vuln/detail/CVE-2024-31866