Search criteria
6 vulnerabilities found for livy by apache
CVE-2025-66249 (GCVE-0-2025-66249)
Vulnerability from nvd – Published: 2026-03-13 15:21 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Unauthorized directory access
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy.
This issue affects Apache Livy: from 0.3.0 before 0.9.0.
The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed.
Users are recommended to upgrade to version 0.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Livy |
Affected:
0.3.0-incubating , < 0.9.0-incubating
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-03-13T16:13:45.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/12/2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-66249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:11:38.674235Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T18:11:59.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.livy:livy-server",
"product": "Apache Livy",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.9.0-incubating",
"status": "affected",
"version": "0.3.0-incubating",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hiroki Egawa"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\u003c/p\u003e\u003cp\u003eThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u0026nbsp;the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\n\nThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\n\nThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u00a0the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\n\nUsers are recommended to upgrade to version 0.9.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T15:21:53.722Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/1xwphsfn4jbtym4k4o0zlvwfogwqwwc3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Livy: Unauthorized directory access",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-66249",
"datePublished": "2026-03-13T15:21:53.722Z",
"dateReserved": "2025-11-25T20:04:17.179Z",
"dateUpdated": "2026-03-13T18:11:59.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-60012 (GCVE-0-2025-60012)
Vulnerability from nvd – Published: 2026-03-13 15:23 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Restrict file access
Summary
Malicious configuration can lead to unauthorized file access in Apache Livy.
This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later.
A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to.
For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.
Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.
Severity ?
No CVSS data available.
CWE
- CWE-20 - Improper Input Validation
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Livy |
Affected:
0.7.0-incubating , < 0.9.0-incubating
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-03-13T16:13:39.867Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/12/1"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-60012",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:10:44.105010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T18:11:24.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.livy:livy-server",
"product": "Apache Livy",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.9.0-incubating",
"status": "affected",
"version": "0.7.0-incubating",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Furue Hideyuki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMalicious configuration can lead to unauthorized file access in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u0026nbsp;Spark 3.1 or later.\u003c/p\u003e\u003cp\u003eA request that includes a Spark configuration value supported from Apache\u0026nbsp;Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\u003c/p\u003e\u003cp\u003eFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Malicious configuration can lead to unauthorized file access in Apache Livy.\n\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u00a0Spark 3.1 or later.\n\nA request that includes a Spark configuration value supported from Apache\u00a0Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\n\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\n\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T15:23:07.334Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Livy: Restrict file access",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-60012",
"datePublished": "2026-03-13T15:23:07.334Z",
"dateReserved": "2025-09-23T19:07:43.584Z",
"dateUpdated": "2026-03-13T18:11:24.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-26544 (GCVE-0-2021-26544)
Vulnerability from nvd – Published: 2021-02-20 09:00 – Updated: 2025-02-13 16:27
VLAI?
Title
Apache Livy (Incubating) is vulnerable to cross site scripting
Summary
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Severity ?
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Livy (Incubating) |
Affected:
Apache Livy (Incubating) 0.7.0-incubating
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.283Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
},
{
"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache Livy (Incubating)",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "Apache Livy (Incubating) 0.7.0-incubating"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "We would like to thank Andras Beni for reporting this issue"
}
],
"descriptions": [
{
"lang": "en",
"value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-03T20:28:08.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
},
{
"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
}
],
"source": {
"defect": [
"https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
],
"discovery": "UNKNOWN"
},
"title": "Apache Livy (Incubating) is vulnerable to cross site scripting",
"workarounds": [
{
"lang": "en",
"value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2021-26544",
"STATE": "PUBLIC",
"TITLE": "Apache Livy (Incubating) is vulnerable to cross site scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Livy (Incubating)",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "Apache Livy (Incubating)",
"version_value": "0.7.0-incubating"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "We would like to thank Andras Beni for reporting this issue"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d",
"refsource": "MISC",
"url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
},
{
"name": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E",
"refsource": "MISC",
"url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
},
{
"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
}
]
},
"source": {
"defect": [
"https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
],
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2021-26544",
"datePublished": "2021-02-20T09:00:15.000Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2025-02-13T16:27:53.277Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-60012 (GCVE-0-2025-60012)
Vulnerability from cvelistv5 – Published: 2026-03-13 15:23 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Restrict file access
Summary
Malicious configuration can lead to unauthorized file access in Apache Livy.
This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later.
A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to.
For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.
Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.
Severity ?
No CVSS data available.
CWE
- CWE-20 - Improper Input Validation
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Livy |
Affected:
0.7.0-incubating , < 0.9.0-incubating
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-03-13T16:13:39.867Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/12/1"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-60012",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:10:44.105010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T18:11:24.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.livy:livy-server",
"product": "Apache Livy",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.9.0-incubating",
"status": "affected",
"version": "0.7.0-incubating",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Furue Hideyuki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMalicious configuration can lead to unauthorized file access in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u0026nbsp;Spark 3.1 or later.\u003c/p\u003e\u003cp\u003eA request that includes a Spark configuration value supported from Apache\u0026nbsp;Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\u003c/p\u003e\u003cp\u003eFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Malicious configuration can lead to unauthorized file access in Apache Livy.\n\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u00a0Spark 3.1 or later.\n\nA request that includes a Spark configuration value supported from Apache\u00a0Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\n\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\n\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T15:23:07.334Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Livy: Restrict file access",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-60012",
"datePublished": "2026-03-13T15:23:07.334Z",
"dateReserved": "2025-09-23T19:07:43.584Z",
"dateUpdated": "2026-03-13T18:11:24.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66249 (GCVE-0-2025-66249)
Vulnerability from cvelistv5 – Published: 2026-03-13 15:21 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Unauthorized directory access
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy.
This issue affects Apache Livy: from 0.3.0 before 0.9.0.
The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed.
Users are recommended to upgrade to version 0.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Livy |
Affected:
0.3.0-incubating , < 0.9.0-incubating
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-03-13T16:13:45.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/12/2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-66249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:11:38.674235Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T18:11:59.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.livy:livy-server",
"product": "Apache Livy",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.9.0-incubating",
"status": "affected",
"version": "0.3.0-incubating",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hiroki Egawa"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\u003c/p\u003e\u003cp\u003eThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u0026nbsp;the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\n\nThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\n\nThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u00a0the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\n\nUsers are recommended to upgrade to version 0.9.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T15:21:53.722Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/1xwphsfn4jbtym4k4o0zlvwfogwqwwc3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Livy: Unauthorized directory access",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-66249",
"datePublished": "2026-03-13T15:21:53.722Z",
"dateReserved": "2025-11-25T20:04:17.179Z",
"dateUpdated": "2026-03-13T18:11:59.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-26544 (GCVE-0-2021-26544)
Vulnerability from cvelistv5 – Published: 2021-02-20 09:00 – Updated: 2025-02-13 16:27
VLAI?
Title
Apache Livy (Incubating) is vulnerable to cross site scripting
Summary
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Severity ?
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Livy (Incubating) |
Affected:
Apache Livy (Incubating) 0.7.0-incubating
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.283Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
},
{
"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache Livy (Incubating)",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "Apache Livy (Incubating) 0.7.0-incubating"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "We would like to thank Andras Beni for reporting this issue"
}
],
"descriptions": [
{
"lang": "en",
"value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-03T20:28:08.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
},
{
"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
}
],
"source": {
"defect": [
"https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
],
"discovery": "UNKNOWN"
},
"title": "Apache Livy (Incubating) is vulnerable to cross site scripting",
"workarounds": [
{
"lang": "en",
"value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2021-26544",
"STATE": "PUBLIC",
"TITLE": "Apache Livy (Incubating) is vulnerable to cross site scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Livy (Incubating)",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "Apache Livy (Incubating)",
"version_value": "0.7.0-incubating"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "We would like to thank Andras Beni for reporting this issue"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d",
"refsource": "MISC",
"url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
},
{
"name": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E",
"refsource": "MISC",
"url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
},
{
"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
}
]
},
"source": {
"defect": [
"https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
],
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2021-26544",
"datePublished": "2021-02-20T09:00:15.000Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2025-02-13T16:27:53.277Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}