CVE-2021-26544: 
Java vulnerability analysis and mitigation

Apache Livy server version 0.7.0-incubating was identified with a cross-site scripting (XSS) vulnerability, tracked as CVE-2021-26544. The vulnerability was discovered in the session name functionality and was disclosed on February 20, 2021. The issue specifically affects only version 0.7.0-incubating of the Apache Livy server (NVD, OSS Security).

The vulnerability is classified as CWE-79 (Cross-site Scripting) with a CVSS v3.1 base score of 5.4 (MEDIUM). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires network access, low attack complexity, low privileges, and user interaction. The vulnerability stems from improper HTML escaping of session names in the web interface (NVD).

When exploited, this vulnerability allows malicious users to access logs and results of other users' sessions and potentially execute jobs with their privileges. The impact is particularly concerning in multi-user environments where session isolation is crucial (OSS Security).

Users are advised to upgrade to Livy version 0.7.1-incubating, which contains the fix for this vulnerability. Alternatively, users can apply the patch available in the GitHub commit that implements HTML escaping for session names (OSS Security, GitHub Patch).