Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2018-1317

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

VectorNETWORK

PublishedApr 23, 2019, 15:29

Published Bysecurity@apache.org

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.zeppelin:zeppelin(Maven)00.8.0N/A

References

http://www.openwall.com/lists/oss-security/2019/04/23/1
http://www.securityfocus.com/bid/108047
https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E
https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html

Weakness Type

CWE-287

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.0

Attack Vector (AV)

NETWORK