[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7da9ac4a-9d4f-d2f9-1869-0a0ea994f0b5@apache.org>
Date: Sun, 03 Aug 2025 10:11:43 +0000
From: PJ Fanning <fanningpj@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-51775: Apache Zeppelin: Command Injection via CSWSH
Severity: moderate
Affected versions:
- Apache Zeppelin (org.apache.zeppelin:zeppelin-shell) 0.11.1 before 0.12.0
Description:
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Credit:
Calum Hutton (finder)
References:
https://github.com/apache/zeppelin/pull/4823
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-51775
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
