Apache Zeppelin: Replacing other users notebook, bypassing any permissions

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-31863 · ADVISORY
• apache/zeppelin commit f025a69 · WEB
• apache/zeppelin · PACKAGE
• lists.apache.org/thread/3od2gfpwllmtc9c5ggw04ohn8s7w3ct9 · WEB
• openwall.com/lists/oss-security/2024/04/09/6 · WEB

More vulnerabilities in org.apache.zeppelin:zeppelin-server

• CVE-2024-41169HIGH 7.5The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories …
• CVE-2024-31867MEDIUM 6.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration p…
• CVE-2024-31865MEDIUM 6.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so…
• CVE-2024-31862MEDIUM 5.3Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: f…
• CVE-2024-31860MEDIUM 6.5Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for …