~ / search / GHSA-74qp-233x-p5j8

GHSA-74qp-233x-p5j8

Apache Livy Cross-site scripting (XSS) in session names

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-26544

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.livy:livy-server >= 0.7.0-incubating, < 0.7.1-incubating 0.7.1-incubating

Details

As written in the advisory (Markdown source, shown as plain text).

Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.

References

External links from the advisory. They lead to third-party sites.