Back to overview

CVE-2025-53648

MEDIUM
5.4
CVSS 3.1
Description
SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to upgrade to version 1.0.0, which fixes this issue.

Metadata

CVE ID
CVE-2025-53648
State
PUBLISHED
Assigner
apache
Reserved
2025-07-08 05:17 UTC
Published
2026-06-30 13:36 UTC
Last updated
2026-06-30 17:35 UTC
Primary CWE
CWE-89
CWE-89 Improper Neutralization of Special Elements used in a…
Vendor / Product
Apache Software Foundation / Apache Gravitino
Sources
cve.org  ·  NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Apache Software Foundation Apache Gravitino — 0.5.0 < 1.0.0
Weakness (CWE)
CWESourceDescription
CWE-89 cna CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.4 MEDIUM 3.1 adp CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References (1)
Back to overview