CVE-2020-13929: Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user

High severity · published Sep 2, 2021

CVE-2020-13929

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user

7.5

CVSS

3.3%

EPSS

On KEV

Description

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.3% · higher than 88% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Zeppelin · Apache

through 0.9.0 · source: NVD

Affected product

Zeppelin

Apache

All Zeppelin CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-13929

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-13929

Mailing List

http://www.openwall.com/lists/oss-security/2021/09/02/2

lists.apache.org

https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cannounce.apache.org%3E

Mailing List

https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E

lists.apache.org

https://lists.apache.org/thread.html/r99529e175a7c1c9a26bd41a02802c8af7aa97319fe561874627eb999%40%3Cusers.zeppelin.apache.org%3E

security.gentoo.org

https://security.gentoo.org/glsa/202311-04