CVE-2024-31866

published 2024-04-09

CVE-2024-31866: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	zeppelin	>= 0.8.2 < 0.11.1	0.11.1
apache_software_foundation	apache_zeppelin	>= 0.8.2 < 0.11.1	0.11.1

CWE-116