CVE-2021-28655

2022-12-1613:15:08

CWE-20

apache

web.nvd.nist.gov

apache zeppelin

cve-2021-28655

input validation

security vulnerability

file deletion

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

0.002

Percentile

53.1%

JSON

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

Affected configurations

Nvd

Vulners

Node

apachezeppelinRange≤0.9.0

VendorProductVersionCPE
apachezeppelin*cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	zeppelin	*	cpe:2.3:a:apache:zeppelin::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Zeppelin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "0.9.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]