title: Apache Zeppelin: Replacing other users notebook, bypassing any permissions
description: Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0.
Users are recommended to upgrade to version 0.11.0, which fixes the issue.
problem types: CWE-290 Authentication Bypass by Spoofing
affected:
{
collectionURL: https://repo.maven.apache.org/maven2
defaultStatus: unaffected
packageName: org.apache.zeppelin:zeppelin-server
product: Apache Zeppelin
vendor: Apache Software Foundation
versions:
lessThan: 0.11.0, status: affected, version: 0.10.1, versionType: semver
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]