CVE Feed

    Dashboard / CVE / CVE-2018-11770

    CVE-2018-11770

    From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.

    Published:Aug 13, 2018
    Last Modified:Nov 21, 2024
    EPS:Aug 13, 2018
    EPSS Score:0.87702
    CVSS Score:4.2

    Affected Products

    Vendor
    Apache
    Product
    Spark

    Exploits

    https://spark.apache.org/security.html#CVE-2018-11770https://spark.apache.org/security.html#CVE-2018-11770https://github.com/ivanitlearning/CVE-2018-11770

    Related CVEs

    CVE-2026-32773 (CVSS 6.1) — There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job …
    CVE-2025-54920 (CVSS 8.8) — This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or …
    CVE-2025-55039 (CVSS 6.5) — This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0…
    CVE-2024-23945 (CVSS 5.9) — Signing cookies is an application security feature that adds a digital signature to cookie data to verify its …
    CVE-2023-32007 (CVSS 8.8) — ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuratio…
    CVE-2023-22946 (CVSS 6.4) — In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,…
    CVE-2022-31777 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote …
    CVE-2022-33891 (CVSS 8.8) — The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With…
    CVE-2021-38296 (CVSS 7.5) — Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.cry…
    CVE-2020-27223 (CVSS 5.2) — In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a requ…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High