CVE-2018-1317

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

Score

CVSS 3.0 8.8 High

Status

Modified - security@apache.org

Published

2019-04-23

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Zeppelin (Apache)
• Apache Zeppelin (Apache Software Foundation)

References

• http://www.openwall.com/lists/oss-security/2019/04/23/1
• http://www.securityfocus.com/bid/108047
• https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apach…
• https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html