PYSEC-2022-42976

vendorUSosv

view advisory published 2022-11-01Licence: CC-BY-4.0

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-31777US	medium5.4	1.64% (76th)	—	2022-11-01
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-43xg-8wmj-cw8hADVISORY
https://lists.apache.org/thread/60mgbswq2lsmrxykfxpqq13ztkm2ht6qWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan