CVE-2024-41169 (GCVE-0-2024-41169)
Vulnerability from cvelistv5
Published
2025-07-12 16:22
Modified
2025-07-14 15:42
Severity ?
CWE
  • CWE-664 - Improper Control of a Resource Through its Lifetime
Summary
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Zeppelin Version: 0.10.1   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-41169",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-14T15:41:04.363543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-14T15:42:07.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.zeppelin:zeppelin-server",
          "product": "Apache Zeppelin",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.12.0",
              "status": "affected",
              "version": "0.10.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SuperX \u003csuperxyyang@gmail.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server\u0027s resources, including directories and files.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.12.0,\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewhich fixes the issue by removing the Cluster Interpreter.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server\u0027s resources, including directories and files.\n\nThis issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.\n\nUsers are recommended to upgrade to version 0.12.0,\u00a0which fixes the issue by removing the Cluster Interpreter."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-664",
              "description": "CWE-664 Improper Control of a Resource Through its Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-12T16:22:35.724Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/zeppelin/pull/4841"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/ZEPPELIN-6101"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd"
        }
      ],
      "source": {
        "advisory": "ZEPPELIN-6101",
        "defect": [
          "https://issues.apache.org/jira/browse/ZEPPELIN-6101"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Zeppelin: raft directory listing and file read",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-41169",
    "datePublished": "2025-07-12T16:22:35.724Z",
    "dateReserved": "2024-07-17T08:42:21.067Z",
    "dateUpdated": "2025-07-14T15:42:07.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41169\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-07-12T17:15:20.817\",\"lastModified\":\"2025-07-29T15:07:15.753\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server\u0027s resources, including directories and files.\\n\\nThis issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.\\n\\nUsers are recommended to upgrade to version 0.12.0,\u00a0which fixes the issue by removing the Cluster Interpreter.\"},{\"lang\":\"es\",\"value\":\"El atacante puede usar el protocolo del servidor Raft sin autenticarse. Puede acceder a los recursos del servidor, incluyendo directorios y archivos. Este problema afecta a Apache Zeppelin desde la versi\u00f3n 0.10.1 hasta la 0.12.0. Se recomienda actualizar a la versi\u00f3n 0.12.0, que soluciona el problema eliminando el int\u00e9rprete de cl\u00faster.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-664\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.10.1\",\"versionEndExcluding\":\"0.12.0\",\"matchCriteriaId\":\"DBF2CC99-1484-40DF-835B-570826CC0DAC\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/zeppelin/pull/4841\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/ZEPPELIN-6101\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Issue Tracking\"]},{\"url\":\"https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\",\"Issue Tracking\",\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41169\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-14T15:41:04.363543Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-14T15:41:22.388Z\"}}], \"cna\": {\"title\": \"Apache Zeppelin: raft directory listing and file read\", \"source\": {\"defect\": [\"https://issues.apache.org/jira/browse/ZEPPELIN-6101\"], \"advisory\": \"ZEPPELIN-6101\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"SuperX \u003csuperxyyang@gmail.com\u003e\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Zeppelin\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.10.1\", \"lessThan\": \"0.12.0\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.zeppelin:zeppelin-server\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/zeppelin/pull/4841\", \"tags\": [\"patch\"]}, {\"url\": \"https://issues.apache.org/jira/browse/ZEPPELIN-6101\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server\u0027s resources, including directories and files.\\n\\nThis issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.\\n\\nUsers are recommended to upgrade to version 0.12.0,\\u00a0which fixes the issue by removing the Cluster Interpreter.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server\u0027s resources, including directories and files.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.12.0,\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ewhich fixes the issue by removing the Cluster Interpreter.\u003c/span\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-664\", \"description\": \"CWE-664 Improper Control of a Resource Through its Lifetime\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2025-07-12T16:22:35.724Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41169\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-14T15:42:07.486Z\", \"dateReserved\": \"2024-07-17T08:42:21.067Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2025-07-12T16:22:35.724Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.