CVE-2017-7678

CVE-2017-7678 is a cross-site scripting (XSS) vulnerability affecting Apache Spark versions prior to 2.2.0. An attacker can leverage a user's trust to trick them into visiting a malicious link, submitting MHTML data containing a script to the Spark master or history server. This script is then reflected back and can be executed by MS Windows-based clients when viewing Spark web UIs. The vulnerability has a CVSS score of 6.1 (MEDIUM), indicating a network-based attack with low complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. While not an attack on Spark itself, it targets the user, potentially leading to inadvertent script execution. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal.