CVE-2022-46870: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

December 16, 2022 (updated November 9, 2023)

An Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users’ browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported version of Zeppelin.

References

lists.apache.org/thread/gb1wdnrm1095xw6qznpsycfrht4lwbwc
nvd.nist.gov/vuln/detail/CVE-2022-46870

Code Behaviors & Features

Detect and mitigate CVE-2022-46870 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →