CVE-2022-31777

CVE-2022-31777: Apache Spark XSS vulnerability in log viewer UI Javascript

Vendor Apache Software Foundation
Product Apache Spark
Weakness CWE-74
Published November 1, 2022
Last update May 6, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Key dates

02Disclosure timeline

November 1, 2022 CVE published
May 6, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-5797 Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields CVE-2024-1128 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A CVE-2019-25150 Email Templates <= 1.3 - HTML Injection CVE-2024-37253 WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability CVE-2024-35728 WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability