HIGH
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session
Published Apr 23, 2019
8.1
HIGHCVSS 3.0
EPSS 4.95%
Description
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
Affected products
-
- Version prior to 0.7.3StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Zeppelin | n/a |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (7)
- http://www.openwall.com/lists/oss-security/2019/04/23/1 mailing-listx_refsource_MLISTMailing ListRelease NotesThird Party Advisory
- http://www.securityfocus.com/bid/108050 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- https://github.com/advisories/GHSA-c538-924g-99q4 Advisory
- https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06@%3Cusers.zeppelin.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2017-12619
- https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html x_refsource_MISCRelease NotesVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2019/04/23/1 | mailing-listx_refsource_MLISTMailing ListRelease NotesThird Party Advisory | |
| http://www.securityfocus.com/bid/108050 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| https://github.com/advisories/GHSA-c538-924g-99q4 | Advisory | |
| https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E | mailing-listx_refsource_MLIST | |
| https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06@%3Cusers.zeppelin.apache.org%3E | ||
| https://nvd.nist.gov/vuln/detail/CVE-2017-12619 | ||
| https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html | x_refsource_MISCRelease NotesVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Apr 23, 2019
Updated Aug 5, 2024
Reserved Aug 7, 2017
Link CVE-2017-12619
CISA Vulnrichment
GHSA-C538-924G-99Q4 Updated n/a