CVE-2017-7678: XSS
In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7678?
CVE-2017-7678 has a medium severity level due to its potential for cross-site scripting attacks.
How do I fix CVE-2017-7678?
To fix CVE-2017-7678, upgrade Apache Spark to version 2.2.0 or later where the vulnerability is addressed.
What impact does CVE-2017-7678 have on Apache Spark?
CVE-2017-7678 allows attackers to submit arbitrary data, including scripts, to the Spark master or history server.
Is CVE-2017-7678 present in all versions of Apache Spark?
CVE-2017-7678 affects versions of Apache Spark below 2.2.0.
Can CVE-2017-7678 be exploited remotely?
Yes, CVE-2017-7678 can be exploited remotely if a user is tricked into clicking a malicious link.