Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache

APACHE

13-03-2026 16:55

CVE-2025-60012 Vulnerabilidad documentada

Sin puntuación

Tags

#apache

#exploit

#db

#config

#vulnerability

#arbitrary

#malicious

#issue

#fix

#exploitable

#configuration

#access

#unauthorized

#affect

Descripción

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Livy 0.7.0 and 0.8.0 when connecting Apache Spark 3.1 or later. A request that includes a Spark value supported from version users gaining files they do not have permissions to. For the vulnerability be exploitable, user needs Livy's REST JDBC interface able send requests with arbitrary values. Users are recommended upgrade 0.9.0 later, which fixes issue.

https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w

http://www.openwall.com/lists/oss-security/2026/03/12/1

Referencia

Link externo

Ver detalles

Fuente

https://nvd.nist.gov/vuln/detail/CVE-2025-60012

Resultados similares

Coincidentes en almenos en 50% de los tags

16-03-2026 CVE-2016-20026
ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server tha...
Ver información

13-03-2026 CVE-2025-66249
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...
Ver información