How severe is CVE-2024-51775?

CVE-2024-51775 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-51775 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-51775?

CVE-2024-51775 affects Apache Zeppelin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-51775?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-51775 have an EU (EUVD) identifier?

Yes. CVE-2024-51775 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54844.

When was CVE-2024-51775 published?

CVE-2024-51775 was published on 2025-08-03 and last updated on 2026-06-17.

CVE-2024-51775

CVE-2024-51775 is a medium-severity vulnerability in Apache Zeppelin with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1385.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-54844
Weakness: CWE-1385
Affected product: Apache Zeppelin
Published: 2025-08-03
Last modified: 2026-06-17

Description

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

Frequently asked questions

What is CVE-2024-51775?: Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.
How severe is CVE-2024-51775?: CVE-2024-51775 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-51775 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-51775?: CVE-2024-51775 affects Apache Zeppelin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-51775?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-51775 have an EU (EUVD) identifier?: Yes. CVE-2024-51775 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54844.
When was CVE-2024-51775 published?: CVE-2024-51775 was published on 2025-08-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Zeppelin

CVE-2024-31866 — Critical (CVSS 9.8): Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or…
CVE-2024-31864 — Critical (CVSS 9.8): Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject…
CVE-2019-10095 — Critical (CVSS 9.8): bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark…
CVE-2018-1317 — High (CVSS 8.8): In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as…
CVE-2017-12619 — High (CVSS 8.1): Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user…
CVE-2024-41169 — High (CVSS 7.5): The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources,…

All CVEs affecting Apache Zeppelin →

Other CWE-1385 vulnerabilities

CVE-2024-23168 — Critical (CVSS 9.8): Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the…
CVE-2025-24964 — Critical (CVSS 9.6): Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when…
CVE-2024-48849 — Critical (CVSS 9.4): Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent…
CVE-2025-52882 — High (CVSS 8.8): Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and…
CVE-2026-34403 — High (CVSS 8.1): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui…
CVE-2025-54289 — High (CVSS 8.1): Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read…

Browse all CWE-1385 vulnerabilities →