CVE-2021-28655mediumCWE-20

CVE-2021-28655: medium-severity vulnerability in Apache Zeppelin

Apache Zeppelin: Arbitrary file deletion vulnerability

Published · Updated

Follow this CVE+ Monitor Apache Zeppelin+ Monitor org.apache.zeppelin:zeppelin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.6%
The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
Apache Software Foundation · Apache Zeppelin
Related CVEs — Apache Zeppelin

In the same product, most dangerous first.

CVE-2018-1328—CVE-2018-1328EPSS 6.0%CVE-2019-10095—bash command injection in spark interpreterEPSS 5.7%CVE-2017-12619—CVE-2017-12619EPSS 4.9%CVE-2018-1317—CVE-2018-1317EPSS 4.6%CVE-2020-13929—Notebook permissions bypassEPSS 3.3%CVE-2021-27578—Cross Site Scripting in markdown interpreterEPSS 3.2%