GitHub Advisoryadvisory · Maven

GHSA-g44m-x5h7-fr5q Apache Zeppelin: Cron arbitrary user impersonation with improper privileges

MEDIUM Published 2024-04-09 Modified 2024-05-02 Official page ↗
Aliases
CVE-2024-31865
Ecosystem
Maven
Packages
org.apache.zeppelin:zeppelin-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-20, CWE-862
Reviewed
2024-04-10

Affected packages

• Maven org.apache.zeppelin:zeppelin-server: >= 0.8.2, < 0.11.1 → fixed in 0.11.1

Description

Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-31865 Improper Input Validation vulnerability in Apache Zeppelin. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-862 Missing Authorization weakness

References