CVE-2024-51775
Aug. 4, 2025, 3:06 p.m.
None
No Score
Description
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Apache |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-1385
Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | apache | zeppelin | 0.11.1-* | / | / | / | / | / | / | |
| a | apache | zeppelin | <0.12.0 | / | / | / | / | / | / | / |
References
Tags
Timeline
Published: Aug. 3, 2025, 11:15 a.m.
Last Modified: Aug. 4, 2025, 3:06 p.m.
Last Modified: Aug. 4, 2025, 3:06 p.m.
Status : Undergoing Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@apache.org
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.