CVE-2024-31868 — Apache Zeppelin: XSS vulnerability in the helium module

Description (CNA)

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Zeppelin	affected 0.8.2 before 0.11.1

CWE

CWE-79

References

https://github.com/apache/zeppelin/pull/4728
https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://github.com/apache/zeppelin/pull/4728
https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11
http://www.openwall.com/lists/oss-security/2024/04/09/11