CVE-2024-31866: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration…

PriorityP260critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.44%

70.2th percentile

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	zeppelin	>= 0.8.2 < 0.11.1	0.11.1
apache_software_foundation	apache_zeppelin	>= 0.8.2 < 0.11.1	0.11.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.