CVE-2024-31865

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31865
Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
CVSS

No CVSS.

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/09/9 Mailing List
http://www.openwall.com/lists/oss-security/2024/04/09/9 Mailing List
https://github.com/apache/zeppelin/pull/4631 Issue Tracking Patch
https://github.com/apache/zeppelin/pull/4631 Issue Tracking Patch
https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l Mailing List Vendor Advisory
https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*
History

05 May 2025, 20:27

Type Values Removed Values Added
References () https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l - () https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l - Mailing List, Vendor Advisory
References () https://github.com/apache/zeppelin/pull/4631 - () https://github.com/apache/zeppelin/pull/4631 - Issue Tracking, Patch
References () http://www.openwall.com/lists/oss-security/2024/04/09/9 - () http://www.openwall.com/lists/oss-security/2024/04/09/9 - Mailing List
CWE NVD-CWE-noinfo
First Time Apache
Apache zeppelin
CPE cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*

13 Feb 2025, 18:18

Type Values Removed Values Added
CWE CWE-20
Summary Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue. Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/09/9 -

09 Apr 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-09 16:15

Updated : 2025-05-05 20:27

NVD link : CVE-2024-31865

Mitre link : CVE-2024-31865

JSON object : View

Products Affected

apache

  • zeppelin
CWE
NVD-CWE-noinfo