NVD Vulnerability Detail

CVE-2020-13929

Summary	Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Publication Date	Sept. 3, 2021, 2:15 a.m.
Registration Date	Sept. 3, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 2:02 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apache:zeppelin::::::::			0.9.0

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2021/09/02/2	Mailing List Third Party Advisory
2	https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cannounce.apache.org%3E
3	https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E	Mailing List Vendor Advisory
4	https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E	Mailing List Vendor Advisory
5	https://lists.apache.org/thread.html/r99529e175a7c1c9a26bd41a02802c8af7aa97319fe561874627eb999%40%3Cusers.zeppelin.apache.org%3E
6	https://security.gentoo.org/glsa/202311-04
7	http://www.openwall.com/lists/oss-security/2021/09/02/2	Mailing List Third Party Advisory
8	https://security.gentoo.org/glsa/202311-04
9	https://lists.apache.org/thread.html/r99529e175a7c1c9a26bd41a02802c8af7aa97319fe561874627eb999%40%3Cusers.zeppelin.apache.org%3E
10	https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E	Mailing List Vendor Advisory
11	https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E	Mailing List Vendor Advisory
12	https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cannounce.apache.org%3E

Common Vulnerabilities List

JVN Vulnerability Information

Apache Zeppelin における脆弱性

Title	Apache Zeppelin における脆弱性
Summary	Apache Zeppelin には、不特定の脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 2, 2021, midnight
Registration Date	July 28, 2022, 12:01 p.m.
Last Update	July 28, 2022, 12:01 p.m.

Affected System

Apache Software Foundation

Zeppelin 0.9.0 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-13929	https://www.cve.org/CVERecord?id=CVE-2020-13929
National Vulnerability Database (NVD)
2	CVE-2020-13929	https://nvd.nist.gov/vuln/detail/CVE-2020-13929
Pony Mail
3	CVE-2020-13929: Apache Zeppelin: Notebook permissions bypass	https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E
関連文書
4	CVE-2020-13929: Apache Zeppelin: Notebook permissions bypass	https://www.openwall.com/lists/oss-security/2021/09/02/2

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Pony Mail
1	Re: CVE-2020-13929: Apache Zeppelin: Notebook permissions bypass	https://lists.apache.org/thread.html/r99529e175a7c1c9a26bd41a02802c8af7aa97319fe561874627eb999@%3Cusers.zeppelin.apache.org%3E

Change Log

No	Changed Details	Date of change
1	[2022年07月05日] 掲載	July 5, 2022, 2:51 p.m.