Description

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

Remediation

References

https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html

http://www.openwall.com/lists/oss-security/2019/04/23/1

http://www.securityfocus.com/bid/108047

https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E

Related Vulnerabilities

CVE-2021-41117 Vulnerability in npm package keypair

CVE-2023-0105 Vulnerability in maven package org.keycloak:keycloak-core

CVE-2023-3224 Vulnerability in npm package nuxt

CVE-2021-22053 Vulnerability in maven package org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard

CVE-2022-29257 Vulnerability in npm package electron

Severity

Critical

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Release Notes Vendor Advisory Mailing List Third Party Advisory VDB Entry