{"action":"Upgrade org.apache.zeppelin:sap to 0.11.0 or later.","affected":[{"fixed":"0.11.0","introduced":"0.8.0"}],"component":"org.apache.zeppelin:sap","cve_ids":["CVE-2022-47894"],"ecosystem":"Maven","epss":0.01327,"exploited":false,"fixed_versions":["0.11.0"],"ghsa_id":"GHSA-rr59-h6rh-v84v","id":"tcs_01M5N9CC7P2S1S8KFKXD14QZ8D","modified_at":"2024-05-02T15:12:14.014539Z","published_at":"2024-04-09T12:30:47Z","references":["https://osv.dev/vulnerability/GHSA-rr59-h6rh-v84v","https://nvd.nist.gov/vuln/detail/CVE-2022-47894","https://github.com/apache/zeppelin/pull/4302","https://github.com/apache/zeppelin/commit/bea51d1467d6103bd8fd68d6a27b14f954d98ec6","https://github.com/apache/zeppelin","https://issues.apache.org/jira/browse/ZEPPELIN-5665","https://lists.apache.org/thread/csf4k73kkn3nx58pm0p2qrylbox4fvyy","http://www.openwall.com/lists/oss-security/2024/04/09/4"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-rr59-h6rh-v84v","url":"https://osv.dev/vulnerability/GHSA-rr59-h6rh-v84v"}],"summary":"Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE"}