Not rated
CVE-2022-31777 A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote…
Description
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Spark | 3.3.0 | No fix stated |
| Apache Spark 3.2 | earliest → 3.2.1 | No fix stated |
References
- lists.apache.org lists.apache.org
- [oss-security] 20221101 CVE-2022-31777: Apache Spark XSS vulnerability in log viewer UI Javascript www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache Spark
The 16 CVEs of Apache Spark →
CVE-2026-32773
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to…
Not rated
CVE-2025-54920
This issue affects Apache Spark: before 3.5.7 and 4.0.1
Not rated
CVE-2025-55039
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0
Not rated
CVE-2024-23945
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its…
Not rated