CVE-2018-1317: High severity Apache Zeppelin vulnerability
Published Apr 23, 2019
·Updated
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
Affected Software
1 affected component
Apache Zeppelin<0.8.0
Event History
Apr 23, 2019
CVE Published
via MITRE·02:45 PM
Data Sourced
via MITRE·02:45 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-1317?
CVE-2018-1317 is classified as a medium severity vulnerability.
2
How do I fix CVE-2018-1317?
To fix CVE-2018-1317, upgrade Apache Zeppelin to version 0.8.0 or later.
3
What systems are affected by CVE-2018-1317?
CVE-2018-1317 affects all versions of Apache Zeppelin prior to 0.8.0.
4
What does CVE-2018-1317 exploit?
CVE-2018-1317 exploits the enabled cron scheduler in Apache Zeppelin, allowing unauthorized users to run paragraphs as other users.
5
Is authentication a concern with CVE-2018-1317?
Yes, CVE-2018-1317 allows users to execute code without proper authentication due to the default configuration.