Lucene search

Veracode Vulnerability DatabaseVERACODE:46392

HistoryApr 12, 2024 - 5:42 p.m.

Improper Input Validation

2024-04-1217:42:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache zeppelin

input validation

vulnerability

cron api

elevated privileges

unauthorized access

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Apache Zeppelin is vulnerable to Improper Input Validation. The vulnerability is due to the cron API with invalid or improper privileges, allowing the notebook to run with elevated privileges. This vulnerability can be exploited by attackers to escalate their privileges and potentially gain unauthorized access or perform unauthorized actions.

CPENameOperatorVersion
zeppelin: serverle0.11.0
zeppelin: serverle0.11.0

CPE	Name	Operator	Version
	zeppelin: server	le	0.11.0
	zeppelin: server	le	0.11.0

References

www.openwall.com/lists/oss-security/2024/04/09/9

github.com/advisories/GHSA-g44m-x5h7-fr5q

github.com/apache/zeppelin/commit/49e2740a1d83d58d2401ccf175fc91ffebfb0892

github.com/apache/zeppelin/pull/4631

lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l