Apache Zeppelin WebSockets Origin Validation Vulnerability

A vulnerability exists in Apache Zeppelin versions 0.11.1 prior to 0.12.0, due to missing origin validation in WebSocket connections. This flaw allows attackers to access the Zeppelin server from untrusted origins, potentially exposing internal information about paragraphs. The issue has been addressed in version 0.12.0.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal information on the Zeppelin server, specifically related to paragraphs.

Remediation

Users are advised to upgrade to Apache Zeppelin version 0.12.0, which includes the necessary origin validation for WebSocket connections.