GHSA-7pgf-ppxw-8624

Source

https://github.com/advisories/GHSA-7pgf-ppxw-8624

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-7pgf-ppxw-8624/GHSA-7pgf-ppxw-8624.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-7pgf-ppxw-8624

Aliases

CVE-2024-41169

Published

2025-07-12T18:30:31Z

Modified

2025-07-14T20:44:48.970806Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Apache Zeppelin exposes server resources to unauthenticated attackers

Details

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.

This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "github_reviewed_at": "2025-07-14T20:31:20Z",
    "cwe_ids": [
        "CWE-664"
    ],
    "nvd_published_at": "2025-07-12T17:15:20Z"
}

References

Affected packages

Maven / org.apache.zeppelin:zeppelin-interpreter

Package

Name: org.apache.zeppelin:zeppelin-interpreter; View open source insights on deps.dev
Purl: pkg:maven/org.apache.zeppelin/zeppelin-interpreter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.10.1

Fixed

0.12.0

Affected versions

0.*

0.10.1

0.11.0

0.11.1

0.11.2

Maven / org.apache.zeppelin:zeppelin-server