CVE-2021-26544 - Vulnerability Details - OpenCVE

Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Livy

Configuration 1 [-]

cpe:2.3:a:apache:livy:0.7.0-incubating:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2021/02/20/1
https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d
https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2021-02-20T09:00:15.000Z

Updated: 2025-02-13T16:27:53.277Z

Reserved: 2021-02-01T00:00:00.000Z

Link: CVE-2021-26544

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-02-20T09:15:12.377

Modified: 2024-11-21T05:56:27.127

Link: CVE-2021-26544

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Apache Livy (Incubating)", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "Apache Livy (Incubating) 0.7.0-incubating"}]}], "credits": [{"lang": "en", "value": "We would like to thank Andras Beni for reporting this issue"}], "descriptions": [{"lang": "en", "value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2024-08-03T20:28:08.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"}, {"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"}, {"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"}], "source": {"defect": ["https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"], "discovery": "UNKNOWN"}, "title": "Apache Livy (Incubating) is vulnerable to cross site scripting", "workarounds": [{"lang": "en", "value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2021-26544", "STATE": "PUBLIC", "TITLE": "Apache Livy (Incubating) is vulnerable to cross site scripting"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Livy (Incubating)", "version": {"version_data": [{"version_affected": "=", "version_name": "Apache Livy (Incubating)", "version_value": "0.7.0-incubating"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "We would like to thank Andras Beni for reporting this issue"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d", "refsource": "MISC", "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"}, {"name": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E", "refsource": "MISC", "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"}, {"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"}]}, "source": {"defect": ["https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"], "discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:26:25.283Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"}, {"name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2021-26544", "datePublished": "2021-02-20T09:00:15.000Z", "dateReserved": "2021-02-01T00:00:00.000Z", "dateUpdated": "2025-02-13T16:27:53.277Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:livy:0.7.0-incubating:*:*:*:*:*:*:*", "matchCriteriaId": "0153E9AC-2495-40AD-8ECF-C242E8416CED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."}, {"lang": "es", "value": "Livy Server versi\u00f3n 0.7.0-incubating (solamente) es vulnerable a un problema de tipo cross site scripting en el nombre de la sesi\u00f3n. Un usuario malicioso podr\u00eda usar este fallo para acceder a los registros y resultados de las sesiones de otros usuarios y ejecutar trabajos con sus privilegios. Este problema es corregido en Livy versi\u00f3n 0.7.1-incubating"}], "id": "CVE-2021-26544", "lastModified": "2024-11-21T05:56:27.127", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-20T09:15:12.377", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"}, {"source": "security@apache.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"}, {"source": "security@apache.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}