CVE-2024-41169: apache zeppelin

csirt@kutim:~/threat-intel/cve/CVE-2024-41169

CVSS 7.5 · High EPSS 0,69%

Kerentanan Improper Control of a Resource Through its Lifetime pada apache zeppelin. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.

Rincian

Terbit di NVD: 12 Juli 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-664: Improper Control of a Resource Through its Lifetime
EPSS (30 hari): 0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	zeppelin	Versi 0.10.1 hingga sebelum 0.12.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/apache/zeppelin/pull/4841 patch · advisory vendor
https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd issue tracking · mailing list · patch · advisory vendor
https://issues.apache.org/jira/browse/ZEPPELIN-6101 issue tracking · patch
http://www.openwall.com/lists/oss-security/2025/07/13/1

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.