CVE-2024-31860

Apache Zeppelin is vulnerable to a Path Traversal vulnerability (CWE-22) in versions 0.9.0 before 0.11.0 . The root cause is improper sanitization of user-supplied input, specifically the failure to properly handle relative path indicators such as ... An attacker can exploit this flaw to view the...

CVE-2019-10095

Apache Zeppelin

CVE-2024-31865

Apache Zeppelin (versions 0.8.2 before 0.11.1 ) is vulnerable to an Improper Input Validation flaw. An attacker can call the updating cron API using invalid or improper privileges, which allows a notebook to run with the elevated privileges of the user associated with the cron job. This could lea...

CVE-2024-31863

CVE-2024-31863 affects Apache Zeppelin. The vulnerability allows authentication bypass by spoofing through replacing existing notes/annotations, effectively bypassing permissions. Affected: Zeppelin 0.10.1 before 0.11.0. Impact: potential unauthorized access via note/annotation replacement. Mitig...

CVE-2022-46870

CVEs summary: CVE-2022-46870 is a cross-site scripting (XSS) vulnerability in Apache Zeppelin up to version 0.8.2. The issue stems from improper neutralization of input during web page generation, allowing logged-in users to execute arbitrary JavaScript in other users’ browsers. Affected product:...

CVE-2022-47894

Apache Zeppelin SAP (versions 0.8.0 through 0.10.x) is vulnerable to an Improper Input Validation flaw, specifically allowing XML External Entity Injection (XXE) . The root cause is a lack of proper XML validation and incorrect restrictions on XML links to external objects . A remote attacker can...

CVE-2024-31864

Apache Zeppelin is vulnerable to a Code Injection vulnerability (CWE-94) due to improper validation of the JDBC driver configuration. An attacker can inject sensitive configuration or malicious code when connecting to a MySQL database via a JDBC driver because the application fails to properly fi...

CVE-2024-31862

The org.apache.zeppelin:zeppelin-server component is vulnerable to an Improper Input Validation flaw when creating a new note via the Zeppelin UI. The root cause is insufficient note path validation , which allows an attacker to send a specially crafted request to cause a Denial of Service (DoS) ...

CVE-2018-1317

CVE-2018-1317 affects Apache Zeppelin prior to 0.8.0, where the cron scheduler was enabled by default. This could allow users to run paragraphs as other users without authentication, constituting an authentication bypass. The documented remediation is to upgrade to Zeppelin 0.8.0 or later, which ...

CVE-2020-13929

Apache Zeppelin = 0.10.1. If upgrading is not feasible, apply vendor/workaround guidance from the advisory. Note: exploitation details are not provided in the sources; no in-the-wild exploit data is included in the documents beyond the stated vulnerability description. Further public technical de...

CVE-2018-1328

CVE-2018-1328 affects Apache Zeppelin prior to 0.8.0, where a stored XSS flaw exists via Note permissions. The root cause is unsanitized input in Note handling that can trigger script execution. Impact is user-facing XSS; remediation is upgrading Zeppelin to 0.8.0 or later (or applying equivalent...

CVE-2021-27578

CVE-2021-27578 is a Cross Site Scripting vulnerability in the Markdown interpreter of Apache Zeppelin. Affected product: Apache Zeppelin (web-based notebook). Affected version: prior to 0.9.0. Root cause: XSS in the markdown interpreter that allows an attacker to inject malicious scripts. Impact:...

CVE-2017-12619

CVE-2017-12619 affects Apache Zeppelin prior to 0.7.3, where a session fixation flaw could allow an attacker to hijack a valid user session. The issue is documented across multiple sources (NVD entry for CVE-2017-12619 and OSV/GHSA advisories) and is commonly described as a session fixation vulne...

CVE-2024-31866

Apache Zeppelin is vulnerable to a Code Injection (CWE-116) flaw due to improper handling of configuration overrides, specifically ZEPPELIN_INTP_CLASSPATH_OVERRIDES . Attackers can exploit this by overriding environment variables to execute shell scripts or inject malicious code . This vulnerabil...

CVE-2024-31867

Apache Zeppelin is vulnerable to an Improper Input Validation vulnerability (specifically LDAP filter injection ) due to insufficient sanitization of LDAP search property configurations. Attackers can exploit this by setting improper configuration properties to execute malicious queries against t...

CVE-2024-31868

Apache Zeppelin is vulnerable to a Cross-Site Scripting (XSS) flaw in its helium module due to improper encoding or escaping of output. An attacker can exploit this by modifying helium.json to inject malicious scripts, which are then exposed to normal users. This vulnerability affects versions fr...

CVE-2021-28656

The org.apache.zeppelin:zeppelin-web component in Apache Zeppelin versions 0.9.0 and prior is vulnerable to a Cross-Site Request Forgery (CSRF) . This vulnerability is caused by inadequate validation of requests on the Credential page , which could allow an attacker to submit malicious requests v...

CVE-2024-41169

Apache Zeppelin versions from 0.10.1 up to 0.12.0 are vulnerable to an Improper Access Control issue. The root cause is that the raft server protocol is accessible in an unauthenticated way, allowing an attacker to view sensitive server resources, including directories and files . This vulnerabil...

CVE-2021-28655

CVE-2021-28655 (Apache Zeppelin) describes an improper input validation in the Move folder to Trash feature, enabling an attacker to delete arbitrary files. Affected product: Apache Zeppelin, version 0.9.0 and prior. Root cause: input validation flaw in the Move folder to Trash flow (NotebookServ...

CVE-2026-44613

Apache Zeppelin (versions 0.6.0 through 0.12.0 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause lies in a default CORS configuration that permits cross-origin state-changing requests and accepts text/plain request bodies. Specifically, the CorsFilter, CorsUtils, and RES...

CVE-2026-44615

A path traversal vulnerability exists in Apache Zeppelin versions 0.9.0 through 0.12.0 . When FileSystemNotebookRepo is configured, an authenticated attacker with permissions to rename a note or perform folder operations can supply traversal segments (such as .. or URL-encoded %2e%2e) in note or ...

CVE-2026-44617

Apache Zeppelin versions 0.11.1 , 0.11.2 , and 0.12.0 are vulnerable to an LDAP filter injection vulnerability within the LdapRealm component. The root cause is that the software used RFC 4514 distinguished-name escaping instead of the required RFC 4515 filter escaping when constructing search fi...

CVE-2024-41177

Apache Zeppelin (specifically the zeppelin-web component) is vulnerable to Cross-Site Scripting (XSS) due to an incomplete blacklist of user input. The vulnerability exists within the Helium module , where insufficient input validation allows an attacker to inject and execute malicious scripts in...

CVE-2024-52279

Apache Zeppelin is vulnerable to an Improper Input Validation flaw in the zeppelin-jdbc component (specifically the JDBC interpreter). The issue stems from an incomplete fix for CVE-2024-31864, where the JDBC URL validation fails to handle URL encoded input . An attacker can submit a specially cr...

CVE-2024-51775

Apache Zeppelin (versions from 0.11.1 before 0.12.0 ) is vulnerable to Missing Origin Validation in WebSockets within the zeppelin-shell component. When using a terminal interpreter (e.g., %sh.terminal), a WebSocket server is spawned on a random port without implementing an origin check. This all...

CVE-2026-44616

An LDAP injection vulnerability exists in Apache Zeppelin versions 0.6.0 through 0.12.0. The ActiveDirectoryGroupRealm component constructs LDAP search filters without properly escaping user-controlled input. This allows an authenticated attacker to inject LDAP filter syntax via the user-search e...