PT-2024-3589 · Apache · Apache Zeppelin Sap

Kuiplatain · Published 2024-04-09 · Updated 2025-05-05 · CVE-2022-47894

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Zeppelin SAP versions 0.8.0 through 0.10.x

Description The issue is related to improper input validation, which can be exploited by a remote attacker to disclose protected information or cause a denial of service using a specially crafted XML request. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations As a temporary workaround, consider restricting access to the instance to trusted users. Find an alternative to Apache Zeppelin SAP, as the project is retired and no fix will be released. Note that the fix was already merged into the source code, but due to the project's retirement, it will not be released as part of a new version.

Fix

XXE

RCE

Weakness Enumeration

CWE-611

CWE-20

Related Identifiers

BDU:2024-03895

CVE-2022-47894

GHSA-RR59-H6RH-V84V

Affected Products

Apache Zeppelin Sap

References · 16

• https://github.com/apache/zeppelin/pull/4302 · Patch
• https://lists.apache.org/thread/csf4k73kkn3nx58pm0p2qrylbox4fvyy · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47894 · Security Note
• https://bdu.fstec.ru/vul/2024-03895 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47894 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rr59-h6rh-v84v · Vendor Advisory
• https://github.com/apache/zeppelin · Note
• https://github.com/apache/zeppelin/commit/bea51d1467d6103bd8fd68d6a27b14f954d98ec6 · Note
• https://github.com/advisories/GHSA-rr59-h6rh-v84v · Note
• https://t.me/cvenotify/76135 · Telegram Post
• http://openwall.com/lists/oss-security/2024/04/09/4 · Note
• https://issues.apache.org/jira/browse/ZEPPELIN-5665 · Note
• https://t.me/cvenotify/120877 · Telegram Post
• https://t.me/cvenotify/92749 · Telegram Post
• https://vuldb.com/?id.259833 · Note