high8.8
CVE-2018-1317
Improper Authentication in Apache Zeppelin
Impact
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.zeppelin:zeppelin | < 0.8.0 | 0.8.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Zeppelin | before 0.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2019/04/23/1
- http://www.securityfocus.com/bid/108047
- https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E
- https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
- https://github.com/advisories/GHSA-9x2h-hvg6-4r5p
- https://nvd.nist.gov/vuln/detail/CVE-2018-1317
- https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06@%3Cusers.zeppelin.apache.org%3E