title: Apache Livy (Incubating) is vulnerable to cross site scripting
description: Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Apache Livy (Incubating)
vendor: Apache Software Foundation
versions:
status: affected, version: Apache Livy (Incubating) 0.7.0-incubating
}
workarounds: Users can upgrade to 0.7.1-incubating or apply the patch at the github URL.