OSS-SEC
Archivos de la lista de correo
De: PJ Fanning Fecha: Sol, 03 de agosto de 2025 10:11:43 +0000
Severity: moderate
Affected versions:
– Apache Zeppelin (org.apache.zeppelin:zeppelin-shell) 0.11.1 before 0.12.0
Description:
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restriction, and get internal information
about paragraphs.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Credit:
Calum Hutton (finder)
References:
https://github.com/apache/zeppelin/pull/4823
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-51775
Hilo actual:
CVE-2024-51775: Apache Zeppelin: inyección de comando a través de CSWSH PJ Fanning (03 de agosto)