CVE-2024-31868

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/apache/zeppelin/pull/4728	Issue Tracking Patch
https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11	Mailing List
http://www.openwall.com/lists/oss-security/2024/04/09/11	Mailing List
https://github.com/apache/zeppelin/pull/4728	Issue Tracking Patch
https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*

History

05 May 2025, 20:11

Type	Values Removed	Values Added
First Time		Apache Apache zeppelin
CPE		cpe:2.3:a:apache:zeppelin::::::::
References	~~() https://github.com/apache/zeppelin/pull/4728 -~~	() https://github.com/apache/zeppelin/pull/4728 - Issue Tracking, Patch
References	~~() https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11 -~~	() https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11 - Mailing List
References	~~() http://www.openwall.com/lists/oss-security/2024/04/09/11 -~~	() http://www.openwall.com/lists/oss-security/2024/04/09/11 - Mailing List

21 Nov 2024, 09:14

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2024/04/09/11 -
References	~~() https://github.com/apache/zeppelin/pull/4728 -~~	() https://github.com/apache/zeppelin/pull/4728 -
References	~~() https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11 -~~	() https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11 -

04 Nov 2024, 17:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1

03 Oct 2024, 13:15

Type	Values Removed	Values Added
Summary	(en) Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.	(en) Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
References	~~{'url': 'http://www.openwall.com/lists/oss-security/2024/04/09/11', 'source': 'security@apache.org'}~~
CWE	~~CWE-116~~	CWE-79

01 May 2024, 18:15

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2024/04/09/11 -

09 Apr 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-09 16:15

Updated : 2025-05-05 20:11

NVD link : CVE-2024-31868

Mitre link : CVE-2024-31868

CVE.ORG link : CVE-2024-31868

JSON object : View

Products Affected

apache

zeppelin

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-31868", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-04-09T16:15:08.413", "references": [{"url": "https://github.com/apache/zeppelin/pull/4728", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11", "tags": ["Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/09/11", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/apache/zeppelin/pull/4728", "tags": ["Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.\n\nThe attackers can modify helium.json and exposure XSS attacks to normal users.\nThis issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de codificaci\u00f3n o escape de salida inadecuados en Apache Zeppelin. Los atacantes pueden modificar helium.json y exponer ataques XSS a usuarios normales. Este problema afecta a Apache Zeppelin: desde 0.8.2 antes de 0.11.1. Se recomienda a los usuarios actualizar a la versi\u00f3n 0.11.1, que soluciona el problema."}], "lastModified": "2025-05-05T20:11:35.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "891BB3D1-5B35-4211-B5D8-9F472D668858", "versionEndExcluding": "0.11.1", "versionStartIncluding": "0.8.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}

6.1 /10