CVE-2025-53648: fallo de gravedad media en Apache Gravitino
Apache Gravitino: SQL misconfiguration can access or truncate files
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.6%
SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.
Users are recommended to upgrade to version 1.0.0, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
Apache Software Foundation · Apache GravitinoCVEs relacionadas — Apache Gravitino
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-41042CRITICALApache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameterEPSS 1.5%CVE-2026-41041CRITICALApache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.EPSS 0.6%CVE-2026-49876MEDIUMApache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIsEPSS 0.5%