CVE-2020-13929: 
Java vulnerability analysis and mitigation

CVE-2020-13929 is an authentication bypass vulnerability discovered in Apache Zeppelin that allows an attacker to bypass the Zeppelin authentication mechanism to act as another user. This critical vulnerability affects Apache Zeppelin version 0.9.0 and all prior versions. The vulnerability was disclosed on September 2, 2021, and was discovered by David Woodhouse (OSS Security).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating that it can be exploited over the network with low attack complexity, requires no privileges or user interaction, and can result in high impact to integrity (NVD).

The vulnerability allows attackers to bypass the authentication mechanism and impersonate other users, potentially gaining unauthorized access to sensitive notebook data and functionality within Apache Zeppelin (OSS Security).

Users are advised to upgrade to Apache Zeppelin version higher than 0.9.0 to address this vulnerability. Gentoo users specifically should upgrade to version 0.10.1 or later (Gentoo Security).