{"id":"CVE-2024-31860","state":"PUBLISHED","title":"Apache Zeppelin: Path traversal vulnerability","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","publishedAt":"2024-04-09T09:08:28.802Z","updatedAt":"2025-05-06T13:12:31.467Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Zeppelin"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Zeppelin","packageName":"org.apache.zeppelin:zeppelin-server","defaultStatus":"unaffected","versions":[{"version":"0.9.0","status":"affected","lessThan":"0.11.0","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":["https://github.com/apache/zeppelin/pull/4632","https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x","http://www.openwall.com/lists/oss-security/2024/04/09/2"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/31xxx/CVE-2024-31860.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-31860","state":"PUBLISHED","datePublished":"2024-04-09T09:08:28.802Z","dateUpdated":"2025-05-06T13:12:31.467Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2024-04-06T11:49:32.612Z"},"containers":{"cna":{"title":"Apache Zeppelin: Path traversal vulnerability","descriptions":[{"lang":"en","value":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Zeppelin","packageName":"org.apache.zeppelin:zeppelin-server","defaultStatus":"unaffected","versions":[{"version":"0.9.0","status":"affected","lessThan":"0.11.0","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":[{"url":"https://github.com/apache/zeppelin/pull/4632","tags":["patch"]},{"url":"https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2025-05-06T13:12:31.467Z"},"credits":[{"lang":"en","type":"finder","value":"Kai Zhao"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"apache","product":"zeppelin","defaultStatus":"unknown","versions":[{"version":"0.9.0","status":"affected"}],"cpes":["cpe:2.3:a:apache:zeppelin:0.9.0:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-31860","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-22T18:40:26.643857Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:36:17.512Z"}},{"title":"CVE Program Container","references":[{"url":"https://github.com/apache/zeppelin/pull/4632","tags":["patch","x_transferred"]},{"url":"https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/09/2","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T01:59:49.933Z"}}]}}}