GitHub Advisoryadvisory · Maven

GHSA-g64r-xf39-q4p5 Apache Zeppelin Path Traversal vulnerability

MEDIUM Published 2024-04-09 Modified 2025-02-13 Official page ↗
Aliases
CVE-2024-31860
Ecosystem
Maven
Packages
org.apache.zeppelin:zeppelin-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-20, CWE-22
Reviewed
2024-04-09

Affected packages

• Maven org.apache.zeppelin:zeppelin-server: >= 0.9.0, < 0.11.0 → fixed in 0.11.0

Description

Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators (e.g `..`), attackers can see the contents for any files in the filesystem that the server account can access.  This issue affects Apache Zeppelin from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-31860 Improper Input Validation vulnerability in Apache Zeppelin. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References