GHSA-rrvf-5w4r-3x7vMediumCVSS 6.1

Apache Zeppelin vulnerable to cross-site scripting in the helium module

Published
April 9, 2024
Last Modified
October 3, 2024

🔗 CVE IDs covered (1)

CVE-2024-31868 →

📋 Description

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

Attackers can modify helium.json and perform cross-site scripting attacks on normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

🎯 Affected products1

  • maven/org.apache.zeppelin:zeppelin-interpreter:>= 0.8.2, < 0.11.1

🔗 References (6)