Apache Zeppelin: Denial of service with invalid notebook name

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-31862 · ADVISORY
• apache/zeppelin#4632 · WEB
• apache/zeppelin commit f025a69 · WEB
• apache/zeppelin · PACKAGE
• lists.apache.org/thread/73xdjx43yg4yz8bd4p3o8vzyybkysmn0 · WEB
• openwall.com/lists/oss-security/2024/04/09/5 · WEB

More vulnerabilities in org.apache.zeppelin:zeppelin-server

• CVE-2024-41169HIGH 7.5The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories …
• CVE-2024-31867MEDIUM 6.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration p…
• CVE-2024-31865MEDIUM 6.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so…
• CVE-2024-31863MEDIUM 5.3Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0…
• CVE-2024-31860MEDIUM 6.5Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for …