{"id":"CVE-2022-31777","aliases":["BIT-spark-2022-31777","EUVD-2022-0218","GHSA-43xg-8wmj-cw8h","PYSEC-2022-42976","ROOT-APP-PYPI-CVE-2022-31777"],"status":"published","title":"Apache Spark XSS vulnerability in log viewer UI Javascript","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0182,"percentile":0.7892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2022-11-01T00:00:00Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"PyPI","package":"pyspark","fixed_in":["3.2.2","3.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.spark:spark-core_2.9.3","fixed_in":["3.2.2"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","fixed_in":["3.2.2","3.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","fixed_in":["3.2.2","3.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.spark:spark-core_2.11","fixed_in":["3.2.2"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"org.apache.spark:spark-core_2.10","fixed_in":["3.2.2"],"sources":["ghsa"]},{"ecosystem":"Bitnami","package":"spark","fixed_in":["3.2.2","3.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.0"},{"fixed":"3.3.1"}]}],"versions":["3.3.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.0"},{"fixed":"3.3.1"}]}],"versions":["3.3.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.0"},{"fixed":"3.3.1"}]}],"versions":["3.3.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"spark","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.2"},{"introduced":"3.3.0"},{"fixed":"3.3.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.1"}]}],"versions":["3.3.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-incubating","0.8.1-incubating"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["3.2.0","3.2.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.1"}]}],"versions":["3.3.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.0-preview","3.0.0-preview2","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.1"}]}],"versions":["3.3.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","2.0.0","2.0.0-preview","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-incubating","0.9.1","0.9.2","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","2.0.0","2.0.0-preview","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3"]},{"source":"osv","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1"]}],"products":[{"vendor":"apache","product":"spark"},{"vendor":"apache software foundation","product":"apache spark"}],"references":[{"url":"https://lists.apache.org/thread/60mgbswq2lsmrxykfxpqq13ztkm2ht6q","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/01/14","tags":["mailing-list","x_transferred","Mailing List","discussion","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31777","tags":["web","advisory"]},{"url":"https://github.com/apache/spark/commit/ad90195de56688ce0898691eb9d04297ab0871ad","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2022-42976.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20220728105026/https://issues.apache.org/jira/browse/SPARK-39505","tags":["web"]},{"url":"https://github.com/advisories/GHSA-43xg-8wmj-cw8h","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31777.json","tags":["advisory"]},{"url":"https://github.com/apache/spark","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31777","title":"Apache Spark XSS vulnerability in log viewer UI Javascript","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2022-11-01T00:00:00Z","modified":"2025-05-06T03:36:31.908Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-0218","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2022-11-01T00:00:00Z","modified":"2025-05-06T03:36:31Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:54.858112Z"}],"ghsa":[{"id":"GHSA-43xg-8wmj-cw8h","title":"Apache Spark vulnerable to Log Injection","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2022-11-01T19:00:29Z","modified":"2025-12-18T15:59:39Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2022-31777","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2022-11-01T16:15:13.367Z","modified":"2026-06-17T04:46:17.31Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:31.504574Z"}],"osv":[{"id":"CVE-2022-31777","title":"Apache Spark XSS vulnerability in log viewer UI Javascript","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2022-11-01T00:00:00Z","modified":"2026-10-28T02:30:52.240463472Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"GHSA-43xg-8wmj-cw8h","title":"Apache Spark vulnerable to Log Injection","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2022-11-01T19:00:29Z","modified":"2025-12-18T16:17:11.831234Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"BIT-spark-2022-31777","title":"Apache Spark XSS vulnerability in log viewer UI Javascript","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2024-03-06T11:05:38.2Z","modified":"2026-09-08T08:48:19.492220465Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"PYSEC-2022-42976","description":"A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.","status":"published","published":"2022-11-01T16:15:00Z","modified":"2026-06-10T17:01:37.003052396Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"ROOT-APP-PYPI-CVE-2022-31777","title":"CVE-2022-31777 in pyspark - Patched by Root","description":"Root has patched CVE-2022-31777 in the pyspark package for Root:PyPI. Multiple fixed versions available.","status":"withdrawn","published":"2026-06-03T20:28:38Z","modified":"2026-08-17T14:00:15.557107036Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}