CVE-2019-10095
bash command injection in spark interpreter
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 5.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
02 Sep 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Affected products
Apache Software Foundation · Apache ZeppelinWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://lists.apache.org/thread.html/rd56389ba9cab30a6c976b9a4a6df0f85cbe8fba6a60a3cf6e3ba716b%40%3Cusers.zeppelin.apache.org%3Ehttps://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208%40%3Cusers.zeppelin.apache.org%3Ehttps://security.gentoo.org/glsa/202311-04http://www.openwall.com/lists/oss-security/2021/09/02/1