VulnerabilityModified

CVE-2024-51775

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

MEDIUM 5.3EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-1385
Affected: apache/zeppelin
Source: security@apache.org

References

https://github.com/apache/zeppelin/pull/4823Issue Tracking
http://www.openwall.com/lists/oss-security/2025/08/03/5

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.