Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
CVE-2024-31865

Currently unrated

Key Information:

Vendor
Apache
Status
Apache Zeppelin
Vendor
CVE Published:
9 April 2024

Summary

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges.

This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected Version(s)

Apache Zeppelin 0.8.2 < 0.11.1

References

https://github.com/apache/zeppelin/pull/4631
patch
https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Esa Hiltunen
https://teragrep.com
.