CVE-2024-31866: Apache Zeppelin: Interpreter download command does not escape malicious code injection
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.
The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELININTPCLASSPATHOVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31866?
CVE-2024-31866 is considered a high severity vulnerability due to its potential for executing arbitrary commands.
How do I fix CVE-2024-31866?
To remediate CVE-2024-31866, upgrade to Apache Zeppelin version 0.11.1 or later.
Which versions of Apache Zeppelin are affected by CVE-2024-31866?
CVE-2024-31866 affects Apache Zeppelin versions from 0.8.2 to just before 0.11.1.
What type of vulnerability is CVE-2024-31866?
CVE-2024-31866 is classified as an improper encoding or escaping of output vulnerability.
What impact does CVE-2024-31866 have?
CVE-2024-31866 allows attackers to execute shell scripts or malicious code by overriding specific configurations.