CVE-2018-1328 Cross-site Scripting in Apache Zeppelin
MediumCVSS 6.1
EPSS 6.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph".
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.zeppelin/zeppelin(Maven) | < 0.8.0 | 0.8.0 |
| org.apache.zeppelin/zeppelin(Maven) | = 0.5.0-incubating | No fix listed |
| org.apache.zeppelin/zeppelin(Maven) | = 0.6.0 | No fix listed |
| org.apache.zeppelin/zeppelin(Maven) | = 0.6.1 | No fix listed |
| org.apache.zeppelin/zeppelin(Maven) | = 0.6.2 | No fix listed |
| org.apache.zeppelin/zeppelin(Maven) | = 0.7.0 | No fix listed |
| org.apache.zeppelin/zeppelin(Maven) | = 0.7.1 | No fix listed |
| org.apache.zeppelin/zeppelin(Maven) | = 0.7.2 | No fix listed |
| org.apache.zeppelin/zeppelin(Maven) | = 0.7.3 | No fix listed |
| apache zeppelin | < 0.8.0 | 0.8.0 |
| Apache Zeppelin | = prior to 0.8.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [oss-security] 20190423 Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0 (CVE-2017-12619 CVE-2018-1317 CVE-2018-1328) mailing-list third-party-advisory
- lists.apache.org
- zeppelin.apache.org vendor-advisory
- github.com
- 108047 third-party-advisory vdb-entry
- [zeppelin-users] 20190423 Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0 (CVE-2017-12619 CVE-2018-1317 CVE-2018-1328) mailing-list