Vulnerability · Published Feb 20, 2021 · Assigned by apache
CVE-2021-26544Apache Livy (Incubating) is vulnerable to cross site scripting
Medium 5.4
In plain English
A medium-severity cross-site scripting in Apache Livy (Incubating) from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)2.8%top 13.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.livy:livy-server | 0.7.1-incubating | GHSA-74qp-233x-p5j8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Livy (Incubating) | Apache Livy (Incubating) 0.7.0-incubating |
Weakness: CWE-79
References
- https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d x_refsource_MISC
- https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E x_refsource_MISC
- [oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting mailing-list, x_refsource_MLIST