CVE-2024-41169CWE-664

Apache Zeppelin: raft directory listing and file read

High · published July 12, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.

This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00693 · 52.4th percentile
Weakness
CWE-664 · Improper Control of a Resource Through its Lifetime
Published
2025-07-12T16:22Z
EPSS history
Timeline
  • 12 JUL 16:22Z
    Apache Zeppelin: raft directory listing and file read
    cvelistv5