CVE-2024-31865

Description

Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

References

https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l

https://github.com/apache/zeppelin/pull/4631

http://www.openwall.com/lists/oss-security/2024/04/09/9

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS