CVE-2021-27578

MEDIUM6.1EPSS 0.70%

Cross-site Scripting in Apache Zeppelin

Published: 9/7/2021Modified: 2/16/2024

Description

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0.

Affected packages (1)

Maven/org.apache.zeppelin:zeppelinfrom 0, < 0.9.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (10)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-27578
PATCHhttps://github.com/apache/zeppelin
WEBhttps://lists.apache.org/thread.html/r31012f2c8e39a5e12e14c1de030012cb8b51c037d953d73b291b7b50@%3Cusers.zeppelin.apache.org%3E
WEBhttps://lists.apache.org/thread.html/r31012f2c8e39a5e12e14c1de030012cb8b51c037d953d73b291b7b50%40%3Cusers.zeppelin.apache.org%3E
WEBhttps://lists.apache.org/thread.html/r90590aa5ea788128ecc2e822e1e64d5200b4cb92b06707b38da4cb3d@%3Cannounce.apache.org%3E
WEBhttps://lists.apache.org/thread.html/r90590aa5ea788128ecc2e822e1e64d5200b4cb92b06707b38da4cb3d@%3Cusers.zeppelin.apache.org%3E
WEBhttps://lists.apache.org/thread.html/r90590aa5ea788128ecc2e822e1e64d5200b4cb92b06707b38da4cb3d%40%3Cannounce.apache.org%3E
WEBhttps://lists.apache.org/thread.html/r90590aa5ea788128ecc2e822e1e64d5200b4cb92b06707b38da4cb3d%40%3Cusers.zeppelin.apache.org%3E
WEBhttps://security.gentoo.org/glsa/202311-04
WEBhttp://www.openwall.com/lists/oss-security/2021/09/02/3