https://seclists.org/oss-sec/2024/q2/49: CVE-2024-31860: Apache Zeppelin: Path traversal vulnerability
Published Apr 9, 2024
·Updated
Affected Software
1 affected component
Apache Zeppelin
Frequently Asked Questions
1
What is the severity of CVE-2024-31860?
CVE-2024-31860 is rated as high severity due to its potential for unauthorized file access.
2
How do I fix CVE-2024-31860?
To fix CVE-2024-31860, update Apache Zeppelin to version 0.11.1 or later, which addresses the vulnerability.
3
What types of attacks can CVE-2024-31860 facilitate?
CVE-2024-31860 can facilitate path traversal attacks, allowing an attacker to access files outside the intended directory.
4
Which versions of Apache Zeppelin are affected by CVE-2024-31860?
CVE-2024-31860 affects all Apache Zeppelin versions prior to 0.11.1.
5
Is there a workaround for CVE-2024-31860 if I cannot immediately upgrade?
As a temporary workaround for CVE-2024-31860, restrict file access permissions on the server until an upgrade can be performed.