CVE-2017-12619

Published: Apr 23, 2019Modified: Nov 21, 2024

8.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".

Affected Products (1)

CPE details will appear after the next data sync.

Apache

1 product

Zeppelin

References (8)

http://www.openwall.com/lists/oss-security/2019/04/23/1

Source: security@apache.org

Mailing ListRelease NotesThird Party Advisory

http://www.securityfocus.com/bid/108050

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E

Source: security@apache.org

https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html

Source: security@apache.org

Release NotesVendor Advisory

http://www.openwall.com/lists/oss-security/2019/04/23/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListRelease NotesThird Party Advisory

http://www.securityfocus.com/bid/108050

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://zeppelin.apache.org/releases/zeppelin-release-0.7.3.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.