CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2024-51775
Medium (5.3) in apache zeppelin. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in org.apache.zeppelin:zeppelin-shell 0.12.0.
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1385
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:zeppelin
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xg8j-j6vp-6h5w | Maven | org.apache.zeppelin:zeppelin-shell | >=0.11.1 <0.12.0 | 0.12.0 |