Threats tagged 'ghsa-3w7g-q5x7-jg2r'

Apache Zeppelin versions 0.6.0 through 0.12.0 have a Cross-Site Request Forgery (CSRF) vulnerability due to a permissive default CORS configuration that allows cross-origin state-changing requests and accepts text/plain request bodies. This enables an attacker to trick an authenticated user into performing unintended actions via REST and WebSocket endpoints. The issue is fixed in version 0.12.1.