The remote web server is running a version of Apache Spark that is affected by a Cross-Site Scripting (XSS) vulnerability due to a flaw in Spark cluster's UI's job and stage info pages, which allows a remote attacker to use specially crafted requests that can lead to arbitrary HTML and script code injection into a user's browser to be executed within the security context of the affected site.

遠端網頁伺服器運行的 Apache Spark 版本，因 Spark 叢集的 UI 工作與階段資訊頁面存在缺陷，受到跨站腳本（XSS）漏洞影響，該漏洞允許遠端攻擊者使用特別設計的請求，導致任意的 HTML 與腳本程式碼注入使用者瀏覽器，並在受影響網站的安全情境下執行。

リモートウェブサーバーはApache Sparkのバージョンを実行しており、SparkクラスターのUIジョブおよびステージ情報ページの欠陥によりCross-Site Scripting(XSS)脆弱性に影響を受けています。これにより、リモート攻撃者が特別に作成されたリクエストを使い、影響を受けたサイトのセキュリティ文脈内でユーザーのブラウザに任意のHTMLやスクリプトコードが注入される可能性があります。

远程网页服务器运行的 Apache Spark 版本因 Spark 集群 UI 作业和阶段信息页存在漏洞，受到跨站脚本（XSS）漏洞影响，该漏洞允许远程攻击者使用专门设计的请求，导致在受影响网站的安全环境中向用户浏览器注入任意的 HTML 和脚本代码。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct
    a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into
    accessing the URL, can be used to cause script to execute and expose information from the user's view of
    the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of
    attack, current versions of Firefox (and possibly others) do not. (CVE-2018-8024)

ID	Name	Product	Family	Published	Updated	Severity
112470	Apache Spark < 2.1.3 / 2.2.x < 2.2.2 / 2.3.x < 2.3.1 XSS in UI	Web App Scanning	Component Vulnerability	9/12/2018	9/7/2021	medium
112470	Apache Spark < 2.1.3 / 2.2.x < 2.2.2 / 2.3.x < 2.3.1 UI 中的 XSS	Web App Scanning	Component Vulnerability	9/12/2018	9/7/2021	medium
112470	Apache Spark < 2.1.3 / 2.2.x < 2.2.2 / 2.3.x < 2.3.1 UI の XSS	Web App Scanning	Component Vulnerability	9/12/2018	9/7/2021	medium
112470	Apache Spark < 2.1.3/2.2.x < 2.2.2/2.3.x < 2.3.1 UI 中存在 XSS	Web App Scanning	Component Vulnerability	9/12/2018	9/7/2021	medium
423533	SCA: security update for org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 (GHSA-8cw6-5qvp-q3wj)	Tenable Cloud Security	SCA Checks	3/29/2025	7/2/2026	medium
423533	SCA: security update for org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 (GHSA-8cw6-5qvp-q3wj)	Tenable Self-Hosted Container Security	SCA Checks	3/29/2025	7/2/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium