CVE-2024-31865

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges.

This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Zeppelin	>= 0.8.2, < 0.11.1
apache	zeppelin	0.8.2

References

http://www.openwall.com/lists/oss-security/2024/04/09/9Mailing List
https://github.com/apache/zeppelin/pull/4631Issue Tracking, Patch
https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81lMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/09/9Mailing List
https://github.com/apache/zeppelin/pull/4631Issue Tracking, Patch
https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81lMailing List, Vendor Advisory

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-318669.8Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by over CVE-2024-318676.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration p CVE-2024-318686.1Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to CVE-2024-318694.3Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the CVE-2024-31875.9This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are cause CVE-2024-318703.3IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacke CVE-2024-318718.1IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deployin CVE-2024-318728.1IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deployin CVE-2024-318737.5IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication CVE-2024-318745.5IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to caus CVE-2024-318785.3IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can CVE-2024-318797.5IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the syste