CVE-2019-10095: falha em Apache Zeppelin
bash command injection in spark interpreter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 5.7%
bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Produtos afetados
Apache Software Foundation · Apache ZeppelinCVEs relacionadas — Apache Zeppelin
No mesmo produto, das mais perigosas para as menos.
CVE-2018-1328—CVE-2018-1328EPSS 6.0%CVE-2017-12619—CVE-2017-12619EPSS 4.9%CVE-2018-1317—CVE-2018-1317EPSS 4.6%CVE-2020-13929—Notebook permissions bypassEPSS 3.3%CVE-2021-27578—Cross Site Scripting in markdown interpreterEPSS 3.2%CVE-2024-31865MEDIUMApache Zeppelin: Cron arbitrary user impersonation with improper privilegesEPSS 1.7%
Referências
https://lists.apache.org/thread.html/rd56389ba9cab30a6c976b9a4a6df0f85cbe8fba6a60a3cf6e3ba716b%40%3Cusers.zeppelin.apache.org%3Ehttps://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208%40%3Cusers.zeppelin.apache.org%3Ehttps://security.gentoo.org/glsa/202311-04http://www.openwall.com/lists/oss-security/2021/09/02/1