CVE-2021-28655 — Improper Input Validation in Software Foundation Apache Zeppelin

CWE-20 — Improper Input Validation4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 37.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache ZeppelinApache Zeppelin
Timeline
PublishedDec 16
Latest updateJul 6

Description

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LExploitability: 3.9 | Impact: 2.5

Affected Packages2 packages

▶NVDapache/zeppelin0.9.0

🔴Vulnerability Details

3
OSV
Apache Zeppelin Improper Input Validation vulnerability↗2023-07-06
▶
GHSA
Apache Zeppelin Improper Input Validation vulnerability↗2023-07-06
▶
CVEList
Apache Zeppelin: Arbitrary file deletion vulnerability↗2022-12-16
▶
CVE-2021-28655 — Improper Input Validation | cvebase