CVE-2021-26544 — Apache Livy (Incubating) is vulnerable to cross site scripting
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of…
Published: 2021-02-20 · CVSS: Unscored
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7