Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2022-31777

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-43xg-8wmj-cw8h

Apache Spark vulnerable to Log Injection A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

gitlab/maven/org.apache.spark/spark-core_2.12/CVE-2022-31777

Apache Spark vulnerable to Log Injection A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

gitlab/maven/org.apache.spark/spark-core_2.13/CVE-2022-31777

Apache Spark vulnerable to Log Injection A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

gitlab/pypi/pyspark/CVE-2022-31777

Apache Spark vulnerable to Log Injection A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

pypa/pyspark/PYSEC-2022-42976

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

pysec/PYSEC-2022-42976

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.