{"id":"CVE-2024-31860","aliases":["EUVD-2024-1201","GHSA-g64r-xf39-q4p5"],"status":"published","title":"Apache Zeppelin: Path traversal vulnerability","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.01386,"percentile":0.72619,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-22"],"published":"2024-04-09T09:08:28Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Maven","package":"org.apache.zeppelin:zeppelin-server","fixed_in":["0.11.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.zeppelin:zeppelin-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.11.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.zeppelin:zeppelin-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.11.0"}]}],"versions":["0.10.0","0.10.1","0.9.0","0.9.0-preview1","0.9.0-preview2"]}],"products":[{"vendor":"apache","product":"zeppelin"},{"vendor":"apache software foundation","product":"apache zeppelin"}],"references":[{"url":"https://github.com/apache/zeppelin/pull/4632","tags":["patch","x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/09/2","tags":["x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31860","tags":["advisory"]},{"url":"https://github.com/apache/zeppelin/commit/f025a697c1d1d0264064d5adf6cb0b20d85041b6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g64r-xf39-q4p5"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31860.json","tags":["advisory"]},{"url":"https://github.com/apache/zeppelin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-31860","title":"Apache Zeppelin: Path traversal vulnerability","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","status":"published","published":"2024-04-09T09:08:28.802Z","modified":"2025-05-06T13:12:31.467Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-1201","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","status":"published","published":"2024-04-09T09:08:28Z","modified":"2025-05-06T13:12:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:54.858112Z"}],"ghsa":[{"id":"GHSA-g64r-xf39-q4p5","title":"Apache Zeppelin Path Traversal vulnerability","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators (e.g `..`), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","status":"published","published":"2024-04-09T09:31:12Z","modified":"2024-05-12T05:03:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2024-31860","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","status":"published","published":"2024-04-09T09:15:26.293Z","modified":"2026-06-17T07:28:51.103Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"CVE-2024-31860","title":"Apache Zeppelin: Path traversal vulnerability","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","status":"published","published":"2024-04-09T09:08:28.802Z","modified":"2026-10-28T02:30:59.304379493Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-g64r-xf39-q4p5","title":"Apache Zeppelin Path Traversal vulnerability","description":"Improper Input Validation vulnerability in Apache Zeppelin.\n\nBy adding relative path indicators (e.g `..`), attackers can see the contents for any files in the filesystem that the server account can access. \nThis issue affects Apache Zeppelin from 0.9.0 before 0.11.0.\n\nUsers are recommended to upgrade to version 0.11.0, which fixes the issue.","status":"published","published":"2024-04-09T09:31:12Z","modified":"2025-02-13T19:13:36.491261Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}