CVE-2024-31860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31860
Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access.  This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/zeppelin/pull/4632 Issue Tracking Patch
https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/09/2 Mailing List
https://github.com/apache/zeppelin/pull/4632 Issue Tracking Patch
https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*
History

06 May 2025, 14:15

Type Values Removed Values Added
References () https://github.com/apache/zeppelin/pull/4632 - () https://github.com/apache/zeppelin/pull/4632 - Issue Tracking, Patch
References () https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x - () https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/04/09/2 - () http://www.openwall.com/lists/oss-security/2024/04/09/2 - Mailing List
CPE cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*
CWE CWE-20 CWE-22
First Time Apache zeppelin
Apache

13 Feb 2025, 18:18

Type Values Removed Values Added
Summary (en) Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access.  This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue. (en) Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access.  This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.
Information

Published : 2024-04-09 09:15

Updated : 2025-05-06 14:15

NVD link : CVE-2024-31860

Mitre link : CVE-2024-31860

CVE.ORG link : CVE-2024-31860

JSON object : View

Products Affected

apache

  • zeppelin
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')