Vulnerabilities > CVE-2020-13929 - Unspecified vulnerability in Apache Zeppelin

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

apache

NVD

Published: 2021-09-02

Updated: 2023-11-24

Summary

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Zeppelin 0.5.0 Apache Zeppelin 0.5.5 Apache Zeppelin 0.5.6 Apache Zeppelin 0.6.0 Apache Zeppelin 0.6.1 Apache Zeppelin 0.6.2 Apache Zeppelin 0.7.0 Apache Zeppelin 0.7.1 Apache Zeppelin 0.7.2 Apache Zeppelin 0.7.3 Apache Zeppelin 0.8.0 Apache Zeppelin 0.8.1 Apache Zeppelin 0.8.2	13

References

https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E
http://www.openwall.com/lists/oss-security/2021/09/02/2
https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r99529e175a7c1c9a26bd41a02802c8af7aa97319fe561874627eb999%40%3Cusers.zeppelin.apache.org%3E
https://security.gentoo.org/glsa/202311-04