Non notée
CVE-2022-31777 A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote…
Description
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Spark | 3.3.0 | Pas de correctif indiqué |
| Apache Spark 3.2 | premières → 3.2.1 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
- [oss-security] 20221101 CVE-2022-31777: Apache Spark XSS vulnerability in log viewer UI Javascript www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Spark
Les 16 CVE de Apache Spark →
CVE-2026-32773
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to…
Non notée
CVE-2025-54920
This issue affects Apache Spark: before 3.5.7 and 4.0.1
Non notée
CVE-2025-55039
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0
Non notée
CVE-2024-23945
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its…
Non notée