CVE-2017-12619

CVE-2017-12619 affects Apache Zeppelin prior to 0.7.3, where a session fixation flaw could allow an attacker to hijack a valid user session. The issue is documented across multiple sources (NVD entry for CVE-2017-12619 and OSV/GHSA advisories) and is commonly described as a session fixation vulne...

CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

CVE-2018-1317: Improper Authentication

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...

PT-2019-8947

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.8.0 Description The issue is related to a stored XSS problem that occurs via Note permissions. It was reported by Josna Joseph. Recommendations For versions prior to 0.8.0, update to version 0.8.0 or later t...

PT-2019-7908

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.7.3 Description The issue allows an attacker to hijack a valid user session through session fixation. This was reported by "stone lone". Recommendations For versions prior to 0.7.3, update to version 0.7.3 o...

CVE-2018-1328: Improper Neutralization of Input During Web Page Generation

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...

CVE-2017-12619: Session Fixation

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

PT-2019-8927

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.8.0 Description The issue allows users to run paragraphs as other users without authentication due to the cron scheduler being enabled by default. Recommendations For versions prior to 0.8.0, update to versi...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +8 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.9.0)

org.apache.hive:hive-exec MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +5 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.9.0)

org.apache.hive:hive-service MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +13 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.11.0)

org.apache.hive:hive-service MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0,...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +18 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.11.0)

org.apache.hive:hive-exec MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0, =1.2.0,...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +3 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (0.11.0)

org.apache.hive:hive-jdbc MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-jdbc and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0, =0.3.3 -...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (0.9.0)

org.apache.hive:hive-jdbc MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-jdbc and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2018-1314 Source advisory:...

SQL Injection

zeppelin-server is vulnerable to SQL injection attacks. It does not sanitized the username but directly getting input from user in the SQL query when retrieving a user list through rest. If an attacker was able to save a username with SQL code in it, this would get executed when the list was bein...

Sensitive Information Exposure

Zeppelin: JDBC interpreter is vulnerable to sensitive information exposure. The vulnerability exists because it does not redact the credentials in interpreter settings page and stores as plaintext in the configuration files...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10, <=0.16), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10, <=0.16) +35 more potentially affected by CVE-2017-15692 via org.apache.geode:geode-core (>=1.0.0-incubating, <=1.3.0)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =0.10, =0.10, =0.3.12, =0.3.5, =0.1.9, =1.16.0, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =1.0.0-incubating, =0.9.0, =2.0.0.release, =2.0.2.release and more Source cves: CVE-2017-1569...

Information Leakage

Apache Zeppelin Zengine is vulnerable to sensitive information leakage. Sensitive information is logged or printed out from Authentication.java when the system data leaves the program through an output stream or logger...

Insecure Random Number Generation

zeppelin is vulnerable to insecure random number generation. It is insecure because it generates predictable random numbers using java.util.Random rather than using a cryptographically secure random number generator...