What is GHSA-86jx-wr74-xr74?

GHSA-86jx-wr74-xr74 is a security advisory published by GitHub Security Advisories with Critical severity. Improper escaping in Apache Zeppelin

Which CVE IDs does GHSA-86jx-wr74-xr74 cover?

GHSA-86jx-wr74-xr74 covers the following CVE IDs: CVE-2024-31866. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-86jx-wr74-xr74?

GHSA-86jx-wr74-xr74 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-86jx-wr74-xr74?

GHSA-86jx-wr74-xr74 affects 1 product, including: maven/org.apache.zeppelin:zeppelin-interpreter:\u003e= 0.8.2, \u003c 0.11.1.

GHSA-86jx-wr74-xr74CriticalCVSS 9.8

Improper escaping in Apache Zeppelin

Vendor

GitHub Security Advisories

Published

April 9, 2024

Last Modified

August 21, 2024

🔗 CVE IDs covered (1)

CVE-2024-31866 →

📋 Description

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

🎯 Affected products1

maven/org.apache.zeppelin:zeppelin-interpreter:>= 0.8.2, < 0.11.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-31866
https://github.com/apache/zeppelin/pull/4715
https://lists.apache.org/thread/jpkbq3oktopt34x2n5wnhzc2r1410ddd
http://www.openwall.com/lists/oss-security/2024/04/09/10
https://github.com/apache/zeppelin/commit/dd08a3966ef3b0b40f13d0291d7cac5ec3dd9f9c
https://github.com/advisories/GHSA-86jx-wr74-xr74