Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

26 records

Vendor: Apache Component: Zeppelin Clear all filters
TI-2024-34680 CVE-2024-51775 · GHSA-xg8j-j6vp-6h5w

Apache Zeppelin: Command Injection via CSWSH

Priority LOW 39

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00289 Published 2025-08-03 Fixed in 0.12.0 CWE-1385
TI-2024-27523 CVE-2024-41177 · GHSA-p288-459w-jxj6

Apache Zeppelin: XSS in the Helium module

Priority LOW 29

Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0073 Published 2025-08-03 Fixed in 0.12.0 CWE-79
TI-2024-20980 CVE-2024-31862 · GHSA-6623-c6mr-6737

Apache Zeppelin: Denial of service with invalid notebook name

Priority LOW 33

Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01365 Published 2024-04-09 Fixed in 0.11.0 CWE-20
TI-2021-09725 CVE-2021-28656 · GHSA-prvg-rh5h-74jr

Apache Zeppelin: CSRF vulnerability in the Credentials page

Priority LOW 25

Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00482 Published 2024-04-09 No fix listed CWE-352
TI-2024-20979 CVE-2024-31860 · GHSA-g64r-xf39-q4p5

Apache Zeppelin: Path traversal vulnerability

Priority LOW 32

Improper Input Validation vulnerability in Apache Zeppelin.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01386 Published 2024-04-09 Fixed in 0.11.0 CWE-22
TI-2022-23214 CVE-2022-46870 · GHSA-9p8j-hrgf-jc2g

Apache Zeppelin: Stored XSS in note permissions

Priority LOW 27

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01192 Published 2022-12-16 Fixed in 0.8.2 CWE-79
TI-2021-09724 CVE-2021-28655 · GHSA-gm67-h5wr-w3cv

Apache Zeppelin: Arbitrary file deletion vulnerability

Priority LOW 38

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01641 Published 2022-12-16 Fixed in 0.10.0 CWE-20
TI-2021-09031 CVE-2021-27578 · GHSA-mf7q-gw5f-q8jj

Cross Site Scripting in markdown interpreter

Priority LOW 33

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03232 Published 2021-09-02 Fixed in 0.9.0 CWE-79
TI-2020-10907 CVE-2020-13929 · GHSA-87p2-cvhq-q4mv

Notebook permissions bypass

Priority LOW 39

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03258 Published 2021-09-02 Fixed in 0.10.0 CWE-287
TI-2019-07420 CVE-2019-10095 · GHSA-4qw8-pgpr-p9mq

bash command injection in spark interpreter

Priority MEDIUM 51

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05747 Published 2021-09-02 Fixed in 0.10.0 CWE-77
TI-2018-01230 CVE-2018-1328 · GHSA-r2v5-5vcr-h3vq

Cross-site scripting in Apache Zeppelin

Priority LOW 36

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.06015 Published 2019-04-23 Fixed in 0.8.0 CWE-79
TI-2018-01220 CVE-2018-1317 · GHSA-9x2h-hvg6-4r5p

Improper authentication in Apache Zeppelin

Priority MEDIUM 45

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0458 Published 2019-04-23 Fixed in 0.8.0 CWE-287
Load more