CVE-2021-28656 Apache Zeppelin: CSRF vulnerability in the Credentials page

2024-04-0909:12:58

CWE-352

apache

github.com

apache zeppelin

csrf

credentials

vulnerability

AI Score

6.9

Confidence

High

EPSS

Percentile

9.0%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Zeppelin",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "0.9.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]