CVE-2024-31868: Apache Zeppelin vulnerable to cross-site scripting in the helium module

April 9, 2024 (updated October 3, 2024)

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

Attackers can modify helium.json and perform cross-site scripting attacks on normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

References

github.com/advisories/GHSA-rrvf-5w4r-3x7v
github.com/apache/zeppelin
github.com/apache/zeppelin/commit/83685795e0ec8d3059fd7a3dbcae5c0532b63b79
github.com/apache/zeppelin/pull/4728
lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11
nvd.nist.gov/vuln/detail/CVE-2024-31868

Code Behaviors & Features

Detect and mitigate CVE-2024-31868 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →