Read the docs
TI-2022-23730 Aliases CVE-2022-47894GHSA-rr59-h6rh-v84v

Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Priority LOW 33CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. For more information, the fix already was merged in the source code but Zeppelin decided to retire the SAP component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01327 71st percentileScored 2026-11-07
Fix Fixed Apache Zeppelin SAP (Apache Software Foundation): 0.11.0org.apache.zeppelin:sap (Maven): 0.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Zeppelin SAP0.8.0 to before 0.11.00.11.0Patch availableCNA
—org.apache.zeppelin:sap (Maven)0.8.0 to before 0.11.00.11.0Patch availableGHSA-rr59-h6rh-v84v
  • Apache Zeppelin SAP VendorApache Affected 0.8.0 to before 0.11.0 Fixed in 0.11.0 Patch available CNA
  • org.apache.zeppelin:sap (Maven) Vendor— Affected 0.8.0 to before 0.11.0 Fixed in 0.11.0 Patch available GHSA-rr59-h6rh-v84v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*0.8.0 to before 0.11.0VulnerableApache
  • cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:* Versions 0.8.0 to before 0.11.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Zeppelin SAP (Apache Software Foundation) Fixed in 0.11.0
  • Fix · GHSA-rr59-h6rh-v84v org.apache.zeppelin:sap (Maven) Fixed in 0.11.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-47894
  2. 2026-10-03 Alias added: GHSA-rr59-h6rh-v84v

References

Patch 1

Advisory 2

Other 4

  • TI-2024-20984 Apache Zeppelin: Interpreter download command does not escape malicious code injection CVSS 3.1CRITICAL 9.8
  • TI-2024-20982 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string CVSS 3.1CRITICAL 9.8
  • TI-2019-07420 bash command injection in spark interpreter CVSS 3.1CRITICAL 9.8
  • TI-2018-01220 Improper authentication in Apache Zeppelin CVSS 3.0HIGH 8.8
  • TI-2017-09344 Session fixation in Apache Zeppelin CVSS 3.0HIGH 8.1
  • TI-2024-34954 Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences