GitHub Advisoryadvisory · Maven

GHSA-7pgf-ppxw-8624 Apache Zeppelin exposes server resources to unauthenticated attackers

HIGH Published 2025-07-12 Modified 2025-11-05 Official page ↗
Aliases
CVE-2024-41169
Ecosystem
Maven
Packages
org.apache.zeppelin:zeppelin-interpreter, org.apache.zeppelin:zeppelin-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-664
Reviewed
2025-07-14

Affected packages

• Maven org.apache.zeppelin:zeppelin-interpreter: >= 0.10.1, < 0.12.0 → fixed in 0.12.0 • Maven org.apache.zeppelin:zeppelin-server: >= 0.10.1, < 0.12.0 → fixed in 0.12.0

Description

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.

Related

Alias · CVE (1)

  • CVE-2024-41169 The attacker can use the raft server protocol in an unauthenticated way. vulnerability

Weakness · CWE (1)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness

References