CVE-2025-9571 (GCVE-0-2025-9571)
Vulnerability from cvelistv5
Published
2025-12-10 07:02
Modified
2025-12-10 15:07
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red
CWE
  • CWE-502 - Deserialization of Untrusted Data
Summary
A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. This could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure. The following CDAP versions include the necessary update to protect against this vulnerability: * 6.10.6+ * 6.11.1+  Users must immediately upgrade to them, or greater ones, available at: https://github.com/cdapio/cdap-build/releases .
References
Impacted products
Vendor Product Version
Google Cloud Cloud Data Fusion Version: 0   < 6.10.6
Version: 0   < 6.11.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9571",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T15:07:00.580352Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T15:07:13.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Data Fusion",
          "vendor": "Google Cloud",
          "versions": [
            {
              "lessThan": "6.10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.11.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tomas La\u017eauninkas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion.\u003cbr\u003eA user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. \u003cbr\u003eThis could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003e\u003cspan style=\"background-color: transparent;\"\u003eThe following CDAP versions include the necessary update to protect against this vulnerability:\u003cul\u003e\u003cli\u003e\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003e 6.10.6+\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003e6.11.1+\u003cbr\u003e\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003e\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003e\u0026nbsp;Users must \u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eimmediately\u0026nbsp;\u003c/span\u003eupgrade to them, or greater ones, available at: \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/cdapio/cdap-build/releases\"\u003ehttps://github.com/cdapio/cdap-build/releases\u003c/a\u003e\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003e.\u003c/span\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e"
            }
          ],
          "value": "A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion.\nA user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. \nThis could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.\n\nThe following CDAP versions include the necessary update to protect against this vulnerability:  *   6.10.6+\n  *  6.11.1+\n\n\n\n\u00a0Users must immediately\u00a0upgrade to them, or greater ones, available at:  https://github.com/cdapio/cdap-build/releases ."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "RED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T07:02:59.932Z",
        "orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
        "shortName": "GoogleCloud"
      },
      "references": [
        {
          "url": "https://docs.cloud.google.com/support/bulletins#gcp-2025-076"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c",
    "assignerShortName": "GoogleCloud",
    "cveId": "CVE-2025-9571",
    "datePublished": "2025-12-10T07:02:59.932Z",
    "dateReserved": "2025-08-28T08:14:06.716Z",
    "dateUpdated": "2025-12-10T15:07:13.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-9571\",\"sourceIdentifier\":\"f45cbf4e-4146-4068-b7e1-655ffc2c548c\",\"published\":\"2025-12-10T07:15:57.820\",\"lastModified\":\"2025-12-10T07:15:57.820\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion.\\nA user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. \\nThis could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.\\n\\nThe following CDAP versions include the necessary update to protect against this vulnerability:  *   6.10.6+\\n  *  6.11.1+\\n\\n\\n\\n\u00a0Users must immediately\u00a0upgrade to them, or greater ones, available at:  https://github.com/cdapio/cdap-build/releases .\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"f45cbf4e-4146-4068-b7e1-655ffc2c548c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"RED\"}}]},\"weaknesses\":[{\"source\":\"f45cbf4e-4146-4068-b7e1-655ffc2c548c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"references\":[{\"url\":\"https://docs.cloud.google.com/support/bulletins#gcp-2025-076\",\"source\":\"f45cbf4e-4146-4068-b7e1-655ffc2c548c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-9571\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-12-10T15:07:00.580352Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-12-10T15:07:09.102Z\"}}], \"cna\": {\"title\": \"Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Tomas La\\u017eauninkas\"}], \"impacts\": [{\"capecId\": \"CAPEC-242\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-242 Code Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"RED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Google Cloud\", \"product\": \"Cloud Data Fusion\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"6.10.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"6.11.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://docs.cloud.google.com/support/bulletins#gcp-2025-076\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion.\\nA user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. \\nThis could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.\\n\\nThe following CDAP versions include the necessary update to protect against this vulnerability:  *   6.10.6+\\n  *  6.11.1+\\n\\n\\n\\n\\u00a0Users must immediately\\u00a0upgrade to them, or greater ones, available at:  https://github.com/cdapio/cdap-build/releases .\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion.\u003cbr\u003eA user with permissions to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. \u003cbr\u003eThis could allow the attacker to gain control over the Data Fusion instance, potentially leading to unauthorized access to sensitive data, modification of data pipelines, and exploration of the underlying infrastructure.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(252, 252, 252);\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eThe following CDAP versions include the necessary update to protect against this vulnerability:\u003cul\u003e\u003cli\u003e\u003cspan style=\\\"background-color: rgb(252, 252, 252);\\\"\u003e 6.10.6+\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan style=\\\"background-color: rgb(252, 252, 252);\\\"\u003e6.11.1+\u003cbr\u003e\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003e\u003cspan style=\\\"background-color: rgb(252, 252, 252);\\\"\u003e\u0026nbsp;Users must \u003cspan style=\\\"background-color: rgb(252, 252, 252);\\\"\u003eimmediately\u0026nbsp;\u003c/span\u003eupgrade to them, or greater ones, available at: \u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://github.com/cdapio/cdap-build/releases\\\"\u003ehttps://github.com/cdapio/cdap-build/releases\u003c/a\u003e\u003cspan style=\\\"background-color: rgb(252, 252, 252);\\\"\u003e.\u003c/span\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"f45cbf4e-4146-4068-b7e1-655ffc2c548c\", \"shortName\": \"GoogleCloud\", \"dateUpdated\": \"2025-12-10T07:02:59.932Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-9571\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-10T15:07:13.842Z\", \"dateReserved\": \"2025-08-28T08:14:06.716Z\", \"assignerOrgId\": \"f45cbf4e-4146-4068-b7e1-655ffc2c548c\", \"datePublished\": \"2025-12-10T07:02:59.932Z\", \"assignerShortName\": \"GoogleCloud\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.