CVE-2024-31868

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.8.2 through 0.11.0

Description The issue is related to improper encoding or escaping of output, allowing attackers to modify helium.json and perform cross-site scripting attacks on normal users.

Recommendations For Apache Zeppelin versions 0.8.2 through 0.11.0, upgrade to version 0.11.1, which fixes the issue. As a temporary workaround, consider restricting access to the helium.json file to minimize the risk of exploitation.