Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability

MEDIUM 5.3CVE-2024-51775 · GHSA-xg8j-j6vp-6h5w · Published 03/08/2025 · updated 17/06/2026

In short

CVE-2024-51775 is a MEDIUM (CVSS 5.3) vulnerability affecting org.apache.zeppelin:zeppelin-shell, zeppelin (apache).
Chance of exploitation in the next 30 days (EPSS): 0.28%, higher than 20.4% of all vulnerabilities.
Fix: update to 0.12.0 or later.

Package	Affected versions	Patched versions
org.apache.zeppelin:zeppelin-shell Maven	`≥ 0.11.1, < 0.12.0`	`0.12.0`
zeppelin apache	`≥ 0.11.0, < 0.12.0`	`0.12.0`

Description

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.

NVD description

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-51775 · ADVISORY
apache/zeppelin#4823 · WEB
apache/zeppelin · PACKAGE
openwall.com/lists/oss-security/2025/08/03/5 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free