CVE-2024-41169
Apache Zeppelin: raft directory listing and file read
- State
- Published
- Severity
- 7.5 High
- Published
- Jul 12, 2025
- Updated
- Nov 4, 2025
- Reserved
- Jul 17, 2024
Description
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.
This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-664 Improper Control of a Resource Through its Lifetime
Affected Products
| Product | Versions |
|---|---|
Apache ZeppelinApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.