NVD
- Id
- 88090
- Name
- CVE-2017-7678
- Description
- In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
- Reject
- CVSS Version
- CVSS Score
- Severity
- CVSS Base Score
- CVSS Impact Subscore
- CVSS Exploit Subscore
- CVSS Vector
- Pub Date
- 2017-07-18
- Published
- 2017-07-12
- Modified Date
- 2017-07-12
- Seq
- 2017-7678
