CVE-2021-26544CWE-79

CVE-2021-26544: vulnerability in Apache Livy (Incubating)

Apache Livy (Incubating) is vulnerable to cross site scripting

Published · Updated

Follow this CVE+ Monitor Apache Livy+ Monitor org.apache.livy:livy-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.8%
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Affected products
Apache Software Foundation · Apache Livy (Incubating)