CVE-2024-31860: Apache Zeppelin: Path traversal vulnerability
First published: Tue Apr 09 2024(Updated: )
Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators (e.g `..`), attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.zeppelin:zeppelin-server | >=0.9.0<0.11.0 | 0.11.0 |
| Apache Zeppelin | >=0.9.0<0.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2024-31860
- https://github.com/apache/zeppelin/pull/4632
- https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x
- https://github.com/apache/zeppelin/commit/f025a697c1d1d0264064d5adf6cb0b20d85041b6
- https://github.com/advisories/GHSA-g64r-xf39-q4p5 (Advisory)
- http://www.openwall.com/lists/oss-security/2024/04/09/2
Frequently Asked Questions
What is the severity of CVE-2024-31860?
CVE-2024-31860 has been classified as a high-severity vulnerability due to improper input validation allowing unauthorized file access.
How do I fix CVE-2024-31860?
To fix CVE-2024-31860, upgrade your Apache Zeppelin installation to version 0.11.0 or later.
What versions of Apache Zeppelin are affected by CVE-2024-31860?
CVE-2024-31860 affects Apache Zeppelin versions from 0.9.0 to below 0.11.0.
What type of vulnerability is CVE-2024-31860?
CVE-2024-31860 is an improper input validation vulnerability.
Can CVE-2024-31860 lead to data exposure?
Yes, CVE-2024-31860 can lead to data exposure by allowing attackers to access filesystem contents accessible to the server account.
- agent/title
- agent/first-publish-date
- agent/type
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-31860
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/references
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-g64r-xf39-q4p5
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/description
- collector/nvd-api
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- package-manager/maven
- vendor/apache
- canonical/apache zeppelin
- version/apache zeppelin/0.9.0