Threats tagged 'ghsa-xg8j-j6vp-6h5w'

Apache Zeppelin versions from 0.11.1 up to but not including 0.12.0 contain a vulnerability due to missing origin validation in WebSockets. This flaw allows an attacker to access the Zeppelin server from an unauthorized origin and retrieve internal information about paragraphs. The issue is fixed in version 0.12.0.