CVE-2024-31861

✕ Withdrawn — historical dataMEDIUMCVSS · not yet scored
—

Code injection in Apache Zeppelin Shell

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.

The attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way. This issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.

CVSS v3
—
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

April 11, 2024

Last Modified

April 11, 2024

Frequently asked(3)

What is CVE-2024-31861?
CVE-2024-31861 is a rejected CVE ID: its record was withdrawn on June 21, 2024 and no longer describes a vulnerability. Reason given: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
When was the CVE record for CVE-2024-31861 published?
The CVE record for CVE-2024-31861 was published on April 11, 2024. EchelonGraph's copy of the record carries a last-modified date of April 11, 2024; the record at its source may have been updated since.
How do I remediate CVE-2024-31861?
There is nothing to remediate under CVE-2024-31861: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.