CVE-2024-41169

HIGH7.5

Apache Zeppelin: raft directory listing and file read

Published Jul 12, 2025

Modified 4 months ago

Details

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.

This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.

References

WEB

http://www.openwall.com/lists/oss-security/2025/07/13/1

FIX

https://github.com/apache/zeppelin/pull/4841

WEB

https://issues.apache.org/jira/browse/ZEPPELIN-6101

ADVISORY

https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-41169

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Other

CWE-664

Ecosystems

Timeline

PublishedJul 12, 2025

ModifiedNov 4, 2025