GitHub Advisoryadvisory · Maven

GHSA-74qp-233x-p5j8 Apache Livy Cross-site scripting (XSS) in session names

MEDIUM Published 2021-05-13 Modified 2023-09-25 Official page ↗
Aliases
CVE-2021-26544
Ecosystem
Maven
Packages
org.apache.livy:livy-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-04-01

Affected packages

• Maven org.apache.livy:livy-server: >= 0.7.0-incubating, < 0.7.1-incubating → fixed in 0.7.1-incubating

Description

Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.

Related

Alias · CVE (1)

  • CVE-2021-26544 Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References