CVE-2021-26544
Apache Livy (Incubating) is vulnerable to cross site scripting
Vexday Risk Score
3Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS —EPSS 2.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
20 feb 2021Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Productos afectados
Apache Software Foundation · Apache Livy (Incubating)¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →