CVE-2021-28656

MEDIUM

Apache Zeppelin < 0.9.0 - Cross-Site Request Forgery in Credential Page

Title source: llm
STIX 2.1

Description

Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

References (2)

Core 2

Scores

CVSS v3 5.4
EPSS 0.0176
EPSS Percentile 82.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
apache/zeppelin < 0.9.0
org.apache.zeppelin/zeppelin-web 0Maven
Published Apr 09, 2024
Tracked Since Feb 18, 2026