CVE-2024-51775CWE-1385

Apache Zeppelin: Command Injection via CSWSH

High · published August 3, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs.

This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Weakness
CWE-1385 · Missing Origin Validation in WebSockets
Published
2025-08-03T10:13Z
EPSS history
Timeline
  • 03 AUG 10:13Z
    Apache Zeppelin: Command Injection via CSWSH
    cvelistv5