Every CVE Search/ Get API key

CVE-2022-31777

Apache Spark XSS vulnerability in log viewer UI Javascript

5.4 MediumFix available

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.82%Up 0.8 points since Nov 2, 2022
90%50%10%1%

What each source reports

NVD Score used 5.4

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
CVE-2022-31777
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
CVE List 5.4

Apache Spark XSS vulnerability in log viewer UI Javascript

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
CVE-2022-31777
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2022-0218 5.4

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
EUVD-2022-0218
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-43xg-8wmj-cw8h 5.4

Apache Spark vulnerable to Log Injection

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
GHSA-43xg-8wmj-cw8h
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
OSV 5.4

Apache Spark XSS vulnerability in log viewer UI Javascript

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
CVE-2022-31777
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
OSVGHSA-43xg-8wmj-cw8h 5.4

Apache Spark vulnerable to Log Injection

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
GHSA-43xg-8wmj-cw8h
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
OSVBIT-spark-2022-31777 No score

Apache Spark XSS vulnerability in log viewer UI Javascript

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
BIT-spark-2022-31777
Updated
2026-11-02
OSVPYSEC-2022-42976 No score

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

Record
PYSEC-2022-42976
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2022-31777 No score

CVE-2022-31777 in pyspark - Patched by Root

Root has patched CVE-2022-31777 in the pyspark package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2022-31777
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pyspark
PyPI
 before 3.2.2
3.2.2
pyspark
PyPI
 3.3.0 to 3.3.0
3.3.1
org.apache.spark:spark-core_2.9.3
Maven
 before 3.2.2
3.2.2
org.apache.spark:spark-core_2.13
Maven
 before 3.2.2
3.2.2
org.apache.spark:spark-core_2.13
Maven
 3.3.0 to 3.3.0
3.3.1
org.apache.spark:spark-core_2.12
Maven
 before 3.2.2
3.2.2
org.apache.spark:spark-core_2.12
Maven
 3.3.0 to 3.3.0
3.3.1
org.apache.spark:spark-core_2.11
Maven
 before 3.2.2
3.2.2
org.apache.spark:spark-core_2.10
Maven
 before 3.2.2
3.2.2
spark
Bitnami
 before 3.2.2, 3.3.0 up to 3.3.1
3.2.23.3.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
pyspark
PyPI
 before 3.2.2, plus listed versions
2.1.12.1.22.1.32.2.02.2.1
Show 25 moreShow less
2.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.83.0.03.0.13.0.23.0.33.1.13.1.23.1.33.2.03.2.1
3.2.2
pyspark
PyPI
 3.3.0 up to 3.3.1
3.3.1
org.apache.spark:spark-core_2.9.3
Maven
 All versions, plus listed versions
0.8.0-incubating0.8.1-incubating
 None known
org.apache.spark:spark-core_2.13
Maven
 before 3.2.2, plus listed versions
3.2.03.2.1
3.2.2
org.apache.spark:spark-core_2.13
Maven
 3.3.0 up to 3.3.1
3.3.1
org.apache.spark:spark-core_2.12
Maven
 before 3.2.2, plus listed versions
2.4.02.4.12.4.22.4.32.4.4
Show 16 moreShow less
2.4.52.4.62.4.72.4.83.0.03.0.0-preview3.0.0-preview23.0.13.0.23.0.33.1.03.1.13.1.23.1.33.2.03.2.1
3.2.2
org.apache.spark:spark-core_2.12
Maven
 3.3.0 up to 3.3.1
3.3.1
org.apache.spark:spark-core_2.11
Maven
 All versions, plus listed versions
1.2.01.2.11.2.21.3.01.3.1
Show 35 moreShow less
1.4.01.4.11.5.01.5.11.5.21.6.01.6.11.6.21.6.32.0.02.0.0-preview2.0.12.0.22.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.8
 None known
org.apache.spark:spark-core_2.10
Maven
 All versions, plus listed versions
0.9.0-incubating0.9.10.9.21.0.01.0.1
Show 29 moreShow less
1.0.21.1.01.1.11.2.01.2.11.2.21.3.01.3.11.4.01.4.11.5.01.5.11.5.21.6.01.6.11.6.21.6.32.0.02.0.0-preview2.0.12.0.22.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.3
 None known

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31777 is a medium vulnerability (CVSS 5.4) in Apache Spark, published November 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in pyspark 3.2.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open