CVE-2019-12370

Name of the Vulnerable Software and Affected Versions Spark application versions 2.0.2 and earlier

Description The issue allows for cross-site scripting (XSS) via an event attribute and arbitrary file loading via a src attribute, provided the application has the READ EXTERNAL STORAGE permission.

Recommendations For Spark application versions 2.0.2 and earlier, consider disabling the READ EXTERNAL STORAGE permission as a temporary workaround until a patch is available. Restrict access to event attributes and src attributes in the application to minimize the risk of exploitation.