GHSA-g64r-xf39-q4p5

Apache Zeppelin Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-31860

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.zeppelin:zeppelin-server	>= 0.9.0, < 0.11.0	0.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators (e.g `..`), attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-31860 advisory
https://github.com/apache/zeppelin/pull/4632 web
https://github.com/apache/zeppelin/commit/f025a697c1d1d0264064d5adf6cb0b20d85041b6 web
https://github.com/apache/zeppelin package
https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x web
http://www.openwall.com/lists/oss-security/2024/04/09/2 web