CVE-2021-28656 — Cross-Site Request Forgery in Software Foundation Apache Zeppelin

CWE-352 — Cross-Site Request Forgery4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
1.8%
top 17.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache ZeppelinApache Zeppelin
Timeline
PublishedApr 9

Description

Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDapache/zeppelin0.9.0

🔴Vulnerability Details

3
OSV
Apache Zeppelin CSRF vulnerability in the Credentials page↗2024-04-09
▶
GHSA
Apache Zeppelin CSRF vulnerability in the Credentials page↗2024-04-09
▶
CVEList
Apache Zeppelin: CSRF vulnerability in the Credentials page↗2024-04-09
▶
CVE-2021-28656 — Cross-Site Request Forgery | cvebase