CVE Feed

    Dashboard / CVE / CVE-2018-11804

    CVE-2018-11804

    Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.

    Published:Oct 24, 2018
    Last Modified:Nov 21, 2024
    EPS:Oct 24, 2018
    EPSS Score:0.00639
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Spark

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-32773 (CVSS 6.1) — There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job …
    CVE-2025-54920 (CVSS 8.8) — This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or …
    CVE-2025-55039 (CVSS 6.5) — This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0…
    CVE-2024-23945 (CVSS 5.9) — Signing cookies is an application security feature that adds a digital signature to cookie data to verify its …
    CVE-2023-32007 (CVSS 8.8) — ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuratio…
    CVE-2023-22946 (CVSS 6.4) — In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,…
    CVE-2022-31777 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote …
    CVE-2022-33891 (CVSS 8.8) — The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With…
    CVE-2021-38296 (CVSS 7.5) — Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.cry…
    CVE-2020-27223 (CVSS 5.2) — In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a requ…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High