CVE-2024-31861
Assigner: apache
Published: 2024-04-11T08:19:58.929Z
State: PUBLISHED
affected: collectionURL: https://repo.maven.apache.org/maven2
defaultStatus: unaffected
packageName: org.apache.zeppelin:zeppelin-shell
product: Apache Zeppelin
vendor: Apache Software Foundation
versions: lessThan: 0.11.1
status: affected
version: 0.10.1
versionType: semver
credits: type: finder
value: Esa Hiltunen
type: finder
value: https://teragrep.com
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.<br><br>The attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way.<br><p>This issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.</p><p>Users are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.</p>
value: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.

The attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way.
This issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.


metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
type: CWE
source: discovery: UNKNOWN
title: Apache Zeppelin: Code injection by Shell interpreter
x_generator: engine: Vulnogram 0.1.0-dev