CVE-2017-7678 | BDVDB-2026-87556 Detail

Description#

In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12017-07-12Record published in the CVE List.
2. Version 22024-08-05Most recent update recorded in the CVE List.