CVE-2024-51775

Description

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs.  This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

Reserved 2024-11-02 | Published 2025-08-03 | Updated 2025-08-03 | Assigner apache

Problem types

CWE-1385 Missing Origin Validation in WebSockets

Product status

Default status
unaffected

0.11.1 before 0.12.0
affected

Credits

Calum Hutton finder

References

github.com/apache/zeppelin/pull/4823 patch

cve.org (CVE-2024-51775)

nvd.nist.gov (CVE-2024-51775)

Download JSON