CVE-2024-31868

2024-04-0916:15:08

CWE-116

[email protected]

web.nvd.nist.gov

improper encoding output

xss attacks

apache zeppelin 0.8.2 - 0.11.1

upgrade required

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.3%

JSON

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can modify helium.json and exposure XSS attacks to normal users.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected configurations

Vulners

Node

apachezeppelinRange≤0.11.1

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.zeppelin:zeppelin-interpreter",
    "product": "Apache Zeppelin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "0.11.1",
        "status": "affected",
        "version": "0.8.2",
        "versionType": "semver"
      }
    ]
  }
]