Product by Apache Software Foundation

    Apache Zeppelin

    26 known vulnerabilities in Apache Zeppelin (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    26

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache Zeppelin (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    CriticalCVE-2019-10095

    bash command injection in spark interpreter

    		9.8
    HighCVE-2018-1317

    Apache Zeppelin: security vulnerability

    		8.8
    HighCVE-2017-12619

    Apache Zeppelin: Session Fixation

    		8.1
    MediumCVE-2018-1328

    Apache Zeppelin: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2020-13929

    Notebook permissions bypass

    		7.5
    CriticalCVE-2024-31866

    Apache Zeppelin: Interpreter download command does not escape malicious code injection

    		9.8
    MediumCVE-2021-27578

    Cross Site Scripting in markdown interpreter

    		6.1
    CriticalCVE-2024-31864

    Apache Zeppelin: Remote code execution by adding malicious JDBC connection string

    		9.8
    MediumCVE-2024-31865

    Apache Zeppelin: Cron arbitrary user impersonation with improper privileges

    		6.5
    MediumCVE-2026-44617

    Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

    		6.5
    MediumCVE-2021-28655

    Apache Zeppelin: Arbitrary file deletion vulnerability

    		6.5
    MediumCVE-2026-44615

    Path traversal in NotebookRepo note and folder path composition

    		6.5
    MediumCVE-2024-31860

    Apache Zeppelin: Path traversal vulnerability

    		6.5
    MediumCVE-2026-44616

    Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction

    		6.5
    MediumCVE-2024-31868

    Apache Zeppelin: XSS vulnerability in the helium module

    		6.1
    MediumCVE-2024-31867

    Apache Zeppelin: LDAP search filter query Injection Vulnerability

    		6.5
    MediumCVE-2024-31862

    Apache Zeppelin: Denial of service with invalid notebook name

    		5.3
    MediumCVE-2022-47894

    Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

    		5.3
    HighCVE-2024-41169

    Apache Zeppelin: raft directory listing and file read

    		7.5
    HighCVE-2024-52279

    Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string

    		5.3
    MediumCVE-2022-46870

    Apache Zeppelin: Stored XSS in note permissions

    		5.4
    MediumCVE-2024-31863

    Apache Zeppelin: Replacing other users notebook, bypassing any permissions

    		5.3
    MediumCVE-2026-44613

    Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

    		6.1
    MediumCVE-2024-41177

    Apache Zeppelin: XSS in the Helium module

    		6.1
    MediumCVE-2021-28656

    Apache Zeppelin: CSRF vulnerability in the Credentials page

    		5.4

    All vulnerabilities in search

    All products by Apache Software Foundation