VulnerabilityAnalyzed
CVE-2024-31868
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.
MEDIUM 6.1EPSS 1.31%
Does this matter?
Lower severity and a low EPSS score (1.31%). Track it; it rarely justifies an emergency change on its own.
Description
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.31% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- apache/zeppelin
- Source
- security@apache.org
References
- https://github.com/apache/zeppelin/pull/4728Issue Tracking, Patch
- https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/09/11Mailing List
- https://github.com/apache/zeppelin/pull/4728Issue Tracking, Patch
- https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.