CVE-2024-31860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31860
Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access.  This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.
CVSS

No CVSS.

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/09/2 Mailing List
https://github.com/apache/zeppelin/pull/4632 Issue Tracking Patch
https://github.com/apache/zeppelin/pull/4632 Issue Tracking Patch
https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x Mailing List Vendor Advisory
https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*
History

05 May 2025, 20:49

Type Values Removed Values Added
CWE CWE-22
First Time Apache
Apache zeppelin
CPE cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*
References () https://github.com/apache/zeppelin/pull/4632 - () https://github.com/apache/zeppelin/pull/4632 - Issue Tracking, Patch
References () http://www.openwall.com/lists/oss-security/2024/04/09/2 - () http://www.openwall.com/lists/oss-security/2024/04/09/2 - Mailing List
References () https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x - () https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x - Mailing List, Vendor Advisory

13 Feb 2025, 18:18

Type Values Removed Values Added
CWE CWE-20
Summary Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access.  This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue. Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access.  This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/09/2 -

09 Apr 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-09 09:15

Updated : 2025-05-06 14:15

NVD link : CVE-2024-31860

Mitre link : CVE-2024-31860

JSON object : View

Products Affected

apache

  • zeppelin
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')