CVE-2024-31868: Apache Zeppelin: XSS vulnerability in the helium module
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.
Attackers can modify helium.json and perform cross-site scripting attacks on normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Other sources
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.
The attackers can modify helium.json and exposure XSS attacks to normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31868?
CVE-2024-31868 has been classified as a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2024-31868?
To fix CVE-2024-31868, upgrade Apache Zeppelin to version 0.11.1 or later.
What versions of Apache Zeppelin are affected by CVE-2024-31868?
CVE-2024-31868 affects Apache Zeppelin versions from 0.8.2 up to, but not including, 0.11.1.
What kind of attacks can be performed due to CVE-2024-31868?
CVE-2024-31868 allows attackers to perform cross-site scripting (XSS) attacks on users by modifying helium.json.
Who is impacted by CVE-2024-31868?
Normal users of Apache Zeppelin versions from 0.8.2 to before 0.11.1 are at risk of being attacked via CVE-2024-31868.