Apache.Zeppelin.WebsocketEventFactory.Stored.XSS

Description

This indicates an attack attempt to exploit a Cross-Site Scripting Vulnerability in Apache Software Foundation Zeppelin.
The vulnerability is due to improper input validation of the permissions, more specifically, the usernames and roles of the note owners. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target system. Successful exploitation could result in the execution of script code in the security context of a target user's browser.

Affected Products

Apache Software Foundation Zeppelin prior to 0.8.2

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://lists.apache.org/thread/gb1wdnrm1095xw6qznpsycfrht4lwbwc

CVE References