{"id":"CVE-2021-26544","aliases":["EUVD-2021-0984","GHSA-74qp-233x-p5j8"],"status":"published","title":"Apache Livy (Incubating) is vulnerable to cross site scripting","description":"Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02816,"percentile":0.86664,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-02-20T09:00:15Z","modified":"2026-10-20T10:54:34Z","fixes":[{"ecosystem":"Maven","package":"org.apache.livy:livy-server","fixed_in":["0.7.1-incubating"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.livy:livy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0-incubating"},{"last_affected":"0.7.0-incubating"},{"fixed":"0.7.1-incubating"}]}],"versions":["0.7.0-incubating"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.livy:livy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0-incubating"},{"fixed":"0.7.1-incubating"}]}],"versions":["0.7.0-incubating"]}],"products":[{"vendor":"apache","product":"livy"},{"vendor":"apache software foundation","product":"apache livy (incubating)"}],"references":[{"url":"https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/02/20/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26544","tags":["advisory"]},{"url":"https://github.com/apache/incubator-livy/commit/9f1ba47a2f0d8accc435b133b42c3a76aa9ac846","tags":["web"]},{"url":"https://github.com/advisories/GHSA-74qp-233x-p5j8"}],"sources":{"cve":[{"id":"CVE-2021-26544","title":"Apache Livy (Incubating) is vulnerable to cross site scripting","description":"Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.","status":"published","published":"2021-02-20T09:00:15Z","modified":"2025-02-13T16:27:53.277Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:57.033395Z"}],"euvd":[{"id":"EUVD-2021-0984","description":"Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.","status":"published","published":"2021-02-20T09:00:15Z","modified":"2025-02-13T16:27:53Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-74qp-233x-p5j8","title":"Apache Livy Cross-site scripting (XSS) in session names","description":"Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.","status":"published","published":"2021-05-13T22:30:41Z","modified":"2023-09-25T11:24:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2021-26544","description":"Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.","status":"published","published":"2021-02-20T09:15:12.377Z","modified":"2026-06-17T03:43:27.76Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"CVE-2021-26544","description":"Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.","status":"published","published":"2021-02-20T09:15:12.377Z","modified":"2026-10-20T10:54:34.752135278Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-74qp-233x-p5j8","title":"Apache Livy Cross-site scripting (XSS) in session names","description":"Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.","status":"published","published":"2021-05-13T22:30:41Z","modified":"2023-11-08T04:05:21.339591Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}