Vulnerability Details CVE-2022-46870
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers.
This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported version of Zeppelin.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.021
EPSS Ranking 83.6%
CVSS Severity
CVSS v3 Score 5.4
References
Products affected by CVE-2022-46870
-
cpe:2.3:a:apache:zeppelin:0.5.0
-
cpe:2.3:a:apache:zeppelin:0.5.5
-
cpe:2.3:a:apache:zeppelin:0.5.6
-
cpe:2.3:a:apache:zeppelin:0.6.0
-
cpe:2.3:a:apache:zeppelin:0.6.1
-
cpe:2.3:a:apache:zeppelin:0.6.2
-
cpe:2.3:a:apache:zeppelin:0.7.0
-
cpe:2.3:a:apache:zeppelin:0.7.1
-
cpe:2.3:a:apache:zeppelin:0.7.2
-
cpe:2.3:a:apache:zeppelin:0.7.3
-
cpe:2.3:a:apache:zeppelin:0.8.0
-
cpe:2.3:a:apache:zeppelin:0.8.1