Apache Zeppelin
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_zeppelin:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Zeppelin (effe849c-71b8-5497-bfac-3fdb5d2e06d6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44617 |
vulnerable | 2026-09-16 04:33:45.707042 |
Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Published: 2026-07-30T15:22:39.054Z
Updated: 2026-07-31T17:53:01.753Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44613 |
vulnerable | 2026-09-16 04:33:45.638582 |
Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Published: 2026-07-30T15:19:40.786Z
Updated: 2026-08-07T14:09:35.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44616 |
vulnerable | 2026-09-16 04:33:45.493669 |
Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction
LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory information. The role-lookup path was also affected after successful LDAP authentication. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Published: 2026-07-30T15:21:21.609Z
Updated: 2026-07-31T17:51:37.685Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44615 |
vulnerable | 2026-09-16 04:33:44.846978 |
Path traversal in NotebookRepo note and folder path composition
Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Published: 2026-07-31T11:05:07.878Z
Updated: 2026-07-31T16:20:12.350Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52279 |
vulnerable | 2026-06-08 06:52:14.706415 |
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Published: 2025-08-03T10:02:05.153Z
Updated: 2025-11-04T21:09:03.247Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51775 |
vulnerable | 2026-06-08 06:52:12.807594 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41177 |
vulnerable | 2026-06-08 06:43:54.254144 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41169 |
vulnerable | 2026-06-08 06:43:54.222795 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31868 |
vulnerable | 2026-06-08 06:35:32.192370 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31867 |
vulnerable | 2026-06-08 06:35:32.191856 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31866 |
vulnerable | 2026-06-08 06:35:32.191335 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31865 |
vulnerable | 2026-06-08 06:35:32.190732 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31864 |
vulnerable | 2026-06-08 06:35:32.188835 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31863 |
vulnerable | 2026-06-08 06:35:32.188118 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31862 |
vulnerable | 2026-06-08 06:35:32.185897 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31860 |
vulnerable | 2026-06-08 06:35:32.184022 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46870 |
vulnerable | 2026-06-08 05:50:39.678511 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28656 |
vulnerable | 2026-06-08 05:31:24.692594 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28655 |
vulnerable | 2026-06-08 05:31:24.692214 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27578 |
vulnerable | 2026-06-08 05:31:21.799260 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13929 |
vulnerable | 2026-06-08 05:18:01.389340 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10095 |
vulnerable | 2026-06-08 05:12:22.234681 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1328 |
vulnerable | 2026-06-08 05:11:17.724029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1317 |
vulnerable | 2026-06-08 05:11:17.677562 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12619 |
vulnerable | 2026-06-08 05:08:47.383235 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.