CVE-2018-1317
HIGHApache Zeppelin < 0.8.0 - Unauthenticated Arbitrary Paragraph Execution via Cron Scheduler
Title source: llmDescription
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
References (4)
Core 4
Core References
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E
Mailing List, Release Notes, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/04/23/1
Release Notes, Vendor Advisory x_refsource_misc
https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/108047
Scores
CVSS v3
8.8
EPSS
0.0329
EPSS Percentile
87.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-287
Status
published
Products (2)
apache/zeppelin
< 0.8.0
org.apache.zeppelin/zeppelin
0 - 0.8.0Maven
Published
Apr 23, 2019
Tracked Since
Feb 18, 2026