Apache Zeppelin CSRF Vulnerability Allows Malicious Request Submission

CVE-2021-28656

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the credential management page of Apache Zeppelin. This vulnerability enables attackers to forge requests that compromise user credentials, potentially allowing unauthorized actions on the server. Users of Apache Zeppelin version 0.9.0 and earlier are particularly affected, as their systems may not adequately validate the authenticity of requests, leaving them open to exploitation. It is vital for organizations utilizing this product to implement security measures to safeguard against such attacks.

References