CVE-2024-31864

Apache Zeppelin is vulnerable to a Code Injection vulnerability (CWE-94) due to improper validation of the JDBC driver configuration. An attacker can inject sensitive configuration or malicious code when connecting to a MySQL database via a JDBC driver because the application fails to properly fi...

CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...

CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...

Apache Zeppelin: Denial of service with invalid notebook name

Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI. This issue affects Apache Zeppelin from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

Apache Zeppelin: Replacing other users notebook, bypassing any permissions

Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin. This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...

GHSA-M65C-WMW9-VMPP Apache Zeppelin: Replacing other users notebook, bypassing any permissions

Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin. This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

GHSA-6623-C6MR-6737 Apache Zeppelin: Denial of service with invalid notebook name

Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI. This issue affects Apache Zeppelin from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

GHSA-RR59-H6RH-V84V Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...

Apache Zeppelin CSRF vulnerability in the Credentials page

Cross-Site Request Forgery CSRF vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

GHSA-PRVG-RH5H-74JR Apache Zeppelin CSRF vulnerability in the Credentials page

Cross-Site Request Forgery CSRF vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

CVE-2024-31863

Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

CVE-2024-31863

Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

CVE-2024-31863 Apache Zeppelin: Replacing other users notebook, bypassing any permissions

Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

CVE-2024-31863 Apache Zeppelin: Replacing other users notebook, bypassing any permissions

Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

CVE-2024-31863

CVE-2024-31863 affects Apache Zeppelin. The vulnerability allows authentication bypass by spoofing through replacing existing notes/annotations, effectively bypassing permissions. Affected: Zeppelin 0.10.1 before 0.11.0. Impact: potential unauthorized access via note/annotation replacement. Mitig...

CVE-2024-31863 Apache Zeppelin: Replacing other users notebook, bypassing any permissions

Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

CVE-2022-47894

Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance t...

CVE-2024-31862

Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...

CVE-2021-28656

Cross-Site Request Forgery CSRF vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...