73 matches found
CVE-2025-66249-POC
CVE-2025-66249 — Apache Livy Path Traversal Whitelist Bypass For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer Overview Field| Detail ---|--- CVE ID| CVE-2025-66249 Severity| Important CVSS...
CVE-2025-60012-POC
For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer CVE-2025-60012 — Apache Livy Unauthorized File Access -yellow Overview Field| Detail ---|--- CVE ID| CVE-2025-60012 Severity| Medium CVSS 6....
CVE-2025-60012
Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...
CVE-2025-66249
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value...
Apache Livy Input Validation Error Vulnerability
Apache Livy is the United States Apache Apache Foundation, an application server . Provides support for programmatic , fault-tolerant , multi-tenant submission of Spark jobs from Web, mobile applications . Apache Livy suffers from an input validation error vulnerability. The vulnerability stems...
com.arangodb:arangodb-spark-connector (>=1.0.0-beta1, <=1.0.7), com.cloudera.livy:livy-repl_2.11 (0.3.0) +71 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.11 (1.6.2)
org.apache.spark:spark-core2.11 MAVEN version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.11 and may be impacted: - com.arangodb:arangodb-spark-connector =1.0.0-beta1, =0.1.52.11, =0.3.0, =0.1.52.11, =0.3.0,...
Exploit for CVE-2025-60012
For educational and security research purposes only. Do not...
Apache Livy: Restrict file access
Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...
org.apache.livy:livy-assembly (>=0.4.0-incubating, <=0.8.0-incubating), org.apache.livy:livy-coverage-report (>=0.4.0-incubating, <=0.8.0-incubating) +3 more potentially affected by CVE-2025-66249 via org.apache.livy:livy-server (>=0.4.0-incubating, <=0.8.0-incubating)
org.apache.livy:livy-server MAVEN version =0.4.0-incubating, =0.4.0-incubating, =0.4.0-incubating, =0.4.0-incubating, =0.6.0-incubating, =2.0.0, =2.8.2 Source cves: CVE-2025-66249 Source advisory: GHSA-H84F-4FF9-8HC3...
EUVD-2025-208637
Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...
GHSA-HM8X-RPGG-7855 Apache Livy: Restrict file access
Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...
Apache Livy: Unauthorized directory access
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value...
GHSA-H84F-4FF9-8HC3 Apache Livy: Unauthorized directory access
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value...
org.apache.livy:livy-assembly (>=0.4.0-incubating, <=0.8.0-incubating), org.apache.livy:livy-coverage-report (>=0.4.0-incubating, <=0.8.0-incubating) +3 more potentially affected by CVE-2025-66249 via org.apache.livy:livy-server (>=0.4.0-incubating, <=0.8.0-incubating)
org.apache.livy:livy-server MAVEN version =0.4.0-incubating, =0.4.0-incubating, =0.4.0-incubating, =0.4.0-incubating, =0.6.0-incubating, =2.0.0, =2.8.2 Source cves: CVE-2025-66249 Source advisory: OSV:GHSA-H84F-4FF9-8HC3...
org.apache.livy:livy-assembly (>=0.7.0-incubating, <=0.8.0-incubating), org.apache.livy:livy-coverage-report (>=0.7.0-incubating, <=0.8.0-incubating) +3 more potentially affected by CVE-2025-60012 via org.apache.livy:livy-server (>=0.7.0-incubating, <=0.8.0-incubating)
org.apache.livy:livy-server MAVEN version =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =2.0.0, =2.8.2 Source cves: CVE-2025-60012 Source advisory: OSV:GHSA-HM8X-RPGG-7855...
org.apache.livy:livy-assembly (>=0.7.0-incubating, <=0.8.0-incubating), org.apache.livy:livy-coverage-report (>=0.7.0-incubating, <=0.8.0-incubating) +3 more potentially affected by CVE-2025-60012 via org.apache.livy:livy-server (>=0.7.0-incubating, <=0.8.0-incubating)
org.apache.livy:livy-server MAVEN version =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =2.0.0, =2.8.2 Source cves: CVE-2025-60012 Source advisory: GHSA-HM8X-RPGG-7855...
org.apache.livy:livy-assembly (>=0.7.0-incubating, <=0.8.0-incubating), org.apache.livy:livy-coverage-report (>=0.7.0-incubating, <=0.8.0-incubating) +3 more potentially affected by CVE-2025-60012 via org.apache.livy:livy-server (>=0.7.0-incubating, <=0.8.0-incubating)
org.apache.livy:livy-server MAVEN version =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =0.7.0-incubating, =2.0.0, =2.8.2 Source cves: CVE-2025-60012 Source advisory: SNYK:JAVA-ORGAPACHELIVY-15674462...
EUVD-2025-208639
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation when processing arbitrary Spark configuration values in requests. An attacker can gain unauthorized access to files by sending specially crafted requests to the REST or JDBC interface. Note: This is only...
CVE-2025-66249
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value...