CVE-2021-26544CWE-79

Apache Livy (Incubating) is vulnerable to cross site scripting

published February 20, 2021

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02816 · 86.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-02-20T09:00Z
EPSS history
Timeline
  • 20 FEB 09:00Z
    Apache Livy (Incubating) is vulnerable to cross site scripting
    cvelistv5