CVE-2024-51775 — Missing Origin Validation in WebSockets in Software Foundation Apache Zeppelin

CWE-1385 — Missing Origin Validation in WebSockets7 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 82.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache ZeppelinApache Zeppelin
Timeline
PublishedAug 3

Description

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/zeppelin0.11.0 — 0.12.0
▶CVEListV5apache_software_foundation/apache_zeppelin0.11.1 — 0.12.0

🔴Vulnerability Details

3
CVEList
Apache Zeppelin: Command Injection via CSWSH↗2025-08-03
▶
GHSA
Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability↗2025-08-03
▶
OSV
Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability↗2025-08-03
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Communications Risk Matrix: Management Service (jose4j) — CVE-2023-51775↗2024-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Automated Test Suite Framework (jose4j) — CVE-2023-51775↗2024-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (jose4j) — CVE-2023-51775↗2024-04-15
▶
CVE-2024-51775 — MEDIUM severity | cvebase