VulnerabilityModified
CVE-2024-41169
The attacker can use the raft server protocol in an unauthenticated way.
HIGH 7.5EPSS 0.61%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.61% probability · 47th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-664
- Affected
- apache/zeppelin
- Source
- security@apache.org
References
- https://github.com/apache/zeppelin/pull/4841Patch, Vendor Advisory
- https://issues.apache.org/jira/browse/ZEPPELIN-6101Issue Tracking, Patch
- https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qddIssue Tracking, Mailing List, Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/07/13/1
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.