CVE-2025-60012 (GCVE-0-2025-60012)

Vulnerability from cvelistv5 – Published: 2026-03-13 15:23 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Restrict file access
Summary
Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to. For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values. Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Livy Affected: 0.7.0-incubating , < 0.9.0-incubating (semver)
Create a notification for this product.
Credits
Furue Hideyuki
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-13T16:13:39.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/12/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-60012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-13T18:10:44.105010Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-13T18:11:24.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.livy:livy-server",
          "product": "Apache Livy",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.9.0-incubating",
              "status": "affected",
              "version": "0.7.0-incubating",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Furue Hideyuki"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMalicious configuration can lead to unauthorized file access in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u0026nbsp;Spark 3.1 or later.\u003c/p\u003e\u003cp\u003eA request that includes a Spark configuration value supported from Apache\u0026nbsp;Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\u003c/p\u003e\u003cp\u003eFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Malicious configuration can lead to unauthorized file access in Apache Livy.\n\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u00a0Spark 3.1 or later.\n\nA request that includes a Spark configuration value supported from Apache\u00a0Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\n\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\n\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T15:23:07.334Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Livy: Restrict file access",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-60012",
    "datePublished": "2026-03-13T15:23:07.334Z",
    "dateReserved": "2025-09-23T19:07:43.584Z",
    "dateUpdated": "2026-03-13T18:11:24.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-60012\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-03-13T19:53:52.530\",\"lastModified\":\"2026-03-16T14:54:11.293\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Malicious configuration can lead to unauthorized file access in Apache Livy.\\n\\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u00a0Spark 3.1 or later.\\n\\nA request that includes a Spark configuration value supported from Apache\u00a0Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\\n\\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\\n\\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/03/12/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/03/12/1\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-03-13T16:13:39.867Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-60012\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-13T18:10:44.105010Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-13T18:11:09.350Z\"}}], \"cna\": {\"title\": \"Apache Livy: Restrict file access\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Furue Hideyuki\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Livy\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.7.0-incubating\", \"lessThan\": \"0.9.0-incubating\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.livy:livy-server\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Malicious configuration can lead to unauthorized file access in Apache Livy.\\n\\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\\u00a0Spark 3.1 or later.\\n\\nA request that includes a Spark configuration value supported from Apache\\u00a0Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\\n\\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\\n\\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMalicious configuration can lead to unauthorized file access in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u0026nbsp;Spark 3.1 or later.\u003c/p\u003e\u003cp\u003eA request that includes a Spark configuration value supported from Apache\u0026nbsp;Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\u003c/p\u003e\u003cp\u003eFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-03-13T15:23:07.334Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-60012\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-13T18:11:24.588Z\", \"dateReserved\": \"2025-09-23T19:07:43.584Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-03-13T15:23:07.334Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.