Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.zeppelin:zeppelin

8 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 medium
Registry
Maven Central

Advisories 8

  • CVE-2022-46870Medium 5.4

    Apache Zeppelin: Stored XSS in note permissions

    Affected: fixed in 0.8.2.

  • CVE-2021-28655Medium 6.5

    Apache Zeppelin: Arbitrary file deletion vulnerability

    Affected: fixed in 0.10.0.

  • Cross Site Scripting in markdown interpreter

    Affected: fixed in 0.9.0.

  • Notebook permissions bypass

    Affected: fixed in 0.10.0.

  • bash command injection in spark interpreter

    Affected: fixed in 0.10.0.

  • Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions.

    Affected: fixed in 0.8.0.

  • In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without…

    Affected: fixed in 0.8.0.

  • Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session.

    Affected: fixed in 0.7.3.