Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-26544

CVE-2021-26544: Apache Livy Cross-site scripting (XSS) in session names

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-26544
GHSA ID
GHSA-74qp-233x-p5j8
EPSS Score
0.89963%
CWE
CWE-79
Published
5/13/2021
Updated
9/25/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.livy:livy-servermaven= 0.7.0-incubating0.7.1-incubating

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The GitHub commit 4d8a912 shows the vulnerability was fixed by adding HTML escaping to session.name in both loadSessionsTable and loadBatchesTable functions. In the vulnerable version 0.7.0, these functions used tdWrap(session.name) without escaping, allowing attackers to inject arbitrary HTML/JS via malicious session names. The direct DOM injection pattern matches classic stored XSS vulnerabilities (CWE-79).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Livy s*rv*r v*rsion *.*.*-in*u**tin* (only) is vuln*r**l* to * *ross sit* s*riptin* issu* in t** s*ssion n*m*. * m*li*ious us*r *oul* us* t*is *l*w to ****ss lo*s *n* r*sults o* ot**r us*rs' s*ssions *n* run jo*s wit* t**ir privil***s. T*is issu* is

Reasoning

T** *it*u* *ommit ******* s*ows t** vuln*r**ility w*s *ix** *y ***in* *TML *s**pin* to `s*ssion.n*m*` in *ot* `lo**S*ssionsT**l*` *n* `lo****t***sT**l*` *un*tions. In t** vuln*r**l* v*rsion *.*.*, t**s* *un*tions us** `t*Wr*p(s*ssion.n*m*)` wit*out *