GitHub Advisoryadvisory · Maven

GHSA-9x2h-hvg6-4r5p Improper Authentication in Apache Zeppelin

HIGH Published 2019-04-24 Modified 2021-08-03 Official page ↗
Aliases
CVE-2018-1317
Ecosystem
Maven
Packages
org.apache.zeppelin:zeppelin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2019-04-24

Affected packages

• Maven org.apache.zeppelin:zeppelin: < 0.8.0 → fixed in 0.8.0

Description

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

Related

Alias · CVE (1)

  • CVE-2018-1317 In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References