Lucene search

China National Vulnerability DatabaseCNVD-2024-17939

HistoryApr 11, 2024 - 12:00 a.m.

Apache Zeppelin Cross-Site Scripting Vulnerability (CNVD-2024-17939)

2024-04-1100:00:00

China National Vulnerability Database

www.cnvd.org.cn

apache zeppelin

web-based

open source

laptop application

interactive data analysis

collaborative documentation

cross-site scripting

vulnerability

improper coding

escaping

helium.json

attack

regular user

AI Score

6.1

Confidence

High

EPSS

Percentile

15.5%

JSON

Apache Zeppelin is a Web-based open source laptop application from the Apache (USA) Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from a cross-site scripting vulnerability that stems from improper coding or escaping, which can be exploited by an attacker to modify helium.json and perform a cross-site scripting attack on a regular user.