← Back

CVE-2024-41169

nvd nist
Published: Jul 12, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.

Affected (1)

Products: Apache: Zeppelin
Apache
1 product
Zeppelin
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Zeppelin
From 0.10.1 to 0.12.0

Related CWEs

CWE-664
Improper Control of a Resource Through its Lifetime
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

References (4)

Source: security@apache.org
PatchVendor Advisory
Source: security@apache.org
Issue TrackingPatch
Source: security@apache.org
Issue TrackingMailing ListPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.