CVE-2022-31777: PYSEC-2022-42976 - A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary

CVE-2022-31777 · Severity: low · CVSS 3.1 · Published 2022-11-01

Technologies: pyspark (PyPI). Vendors: PyPI.

Executive brief

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Affected products

PyPI pyspark

Related threats

Apache Spark History Server XSS in job names
Apache Spark Inadequate Encryption Strength in RPC Communication
PYSEC-2023-72 - ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. Wi
PYSEC-2023-44 - In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The appl
Apache Spark OS command injection in Spark UI via impersonation