title: Apache Zeppelin: Stored XSS in note permissions
description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers.
This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported version of Zeppelin.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: Apache Zeppelin
vendor: Apache Software Foundation
versions:
lessThan: 0.8.2, status: affected, version: 0, versionType: maven
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]