CVE-2024-31865
published 2024-04-09CVE-2024-31865: Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook…
PriorityP338medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
1.72%
74.9th percentile
Improper Input Validation vulnerability in Apache Zeppelin.
The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zeppelin | >= 0.8.2 < 0.11.1 | 0.11.1 |
| apache_software_foundation | apache_zeppelin | >= 0.8.2 < 0.11.1 | 0.11.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
ghsa·2024-04-09
CVE-2024-31865 [MEDIUM] CWE-20 Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
Improper Input Validation vulnerability in Apache Zeppelin.
The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
OSV
Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
osv·2024-04-09
CVE-2024-31865 [MEDIUM] Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
Improper Input Validation vulnerability in Apache Zeppelin.
The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2024/04/09/9https://github.com/apache/zeppelin/pull/4631https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81lhttp://www.openwall.com/lists/oss-security/2024/04/09/9https://github.com/apache/zeppelin/pull/4631https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l
2024-04-09
Published