CRITICAL🇵🇱 Wersja polska

CVE-2019-10095

CVSS 9.8v3.1pub. 2021-09-02upd. 2024-11-21

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Zeppelin

    APP
    Apache
    ≤ 0.9.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-31864CRITICAL9.8PL ✓ten sam produkt

Apache Zeppelin: Code Injection przez JDBC przy połączeniu z MySQL

CVE-2024-31866CRITICAL9.8PL ✓ten sam produkt

Apache Zeppelin — wykonanie kodu przez nieprawidłowe kodowanie konfiguracji

CVE-2024-41169HIGH7.5ten sam produkt

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's res...

CVE-2020-13929HIGH7.5ten sam produkt

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication me...

CVE-2017-12619HIGH8.1ten sam produkt

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid ...