High severity8.8NVD Advisory· Published Apr 23, 2019· Updated Jun 17, 2026

CVE-2018-1317

Description

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.zeppelin:zeppelinMaven	< 0.8.0	0.8.0

Affected products

Apache/Zeppelin2 versions
cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*range: <0.8.0
- (no CPE)range: prior to 0.8.0
ghsa-coords
pkg:maven/org.apache.zeppelin/zeppelin
Range: < 0.8.0

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2019/04/23/1nvdMailing ListRelease NotesThird Party AdvisoryWEB
www.securityfocus.com/bid/108047nvdThird Party AdvisoryVDB Entry
github.com/advisories/GHSA-9x2h-hvg6-4r5pghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2018-1317ghsaADVISORY
zeppelin.apache.org/releases/zeppelin-release-0.8.0.htmlnvdRelease NotesVendor AdvisoryWEB
lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06@%3Cusers.zeppelin.apache.org%3EghsaWEB
lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000