PT-2024-24254 · Apache · Apache Zeppelin

Esa Hiltunen

·

CVE-2024-31866

·

Published

2024-04-09

·

Updated

2025-05-05

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.8.2 through 0.11.0
Description The issue is related to improper encoding or escaping of output, allowing attackers to execute shell scripts or malicious code by overriding configuration like ZEPPELIN INTP CLASSPATH OVERRIDES.
Recommendations For Apache Zeppelin versions 0.8.2 through 0.11.0, upgrade to version 0.11.1, which fixes the issue.

Exploit

Fix

Improper Encoding or Escaping of Output

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2024-31866
GHSA-86JX-WR74-XR74

Affected Products

Apache Zeppelin