PT-2019-8947

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.8.0 Description The issue is related to a stored XSS problem that occurs via Note permissions. It was reported by Josna Joseph. Recommendations For versions prior to 0.8.0, update to version 0.8.0 or later t...

CVE-2017-12619: Session Fixation

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

PT-2019-8927

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.8.0 Description The issue allows users to run paragraphs as other users without authentication due to the cron scheduler being enabled by default. Recommendations For versions prior to 0.8.0, update to versi...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +5 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.9.0)

org.apache.hive:hive-service MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +18 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.11.0)

org.apache.hive:hive-exec MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0, =1.2.0,...

Information Leakage

Apache Zeppelin Zengine is vulnerable to sensitive information leakage. Sensitive information is logged or printed out from Authentication.java when the system data leaves the program through an output stream or logger...