CVE-2018-8024: fallo en Apache Spark
Publicada el · Actualizada el
18Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 5.3%
probabilidad de explotación
5.3%top 8% de las CVE
explotación observada
noninguna fuente lo reporta
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.
Productos afectados
Apache Software Foundation · Apache SparkCVEs relacionadas — Apache Spark
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-33891HIGHApache Spark shell command injection vulnerability via Spark UIEPSS 93.2%KEVCVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2018-11770—CVE-2018-11770EPSS 65.8%CVE-2020-9480—CVE-2020-9480EPSS 29.4%CVE-2018-17190—CVE-2018-17190EPSS 8.8%CVE-2018-11804—CVE-2018-11804EPSS 5.7%