CVE-2018-8024
Last modified
CVE-2018-8024 is a vulnerability of currently unknown severity. In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.. EPSS estimates a 5.05% chance of exploitation in the next 30 days.
Description
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Spark | >= 2.1.0, <= 2.1.2 |
| Apache | Spark | >= 2.2.0, <= 2.2.1 |
| Apache | Spark | 2.3.0 |
| Mozilla | Firefox | All versions |
References
- https://spark.apache.org/security.html#CVE-2018-8024Mitigation, Vendor Advisory
- https://spark.apache.org/security.html#CVE-2018-8024Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-8024?
How severe is CVE-2018-8024?
How do I fix CVE-2018-8024?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-8018In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the se…
- CVE-2018-8019When using an OCSP responder Apache Tomcat Native 1.2.0 to 1…
- CVE-2018-8020Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 ha…
- CVE-2018-8021Versions of Superset prior to 0.23 used an unsafe load metho…
- CVE-2018-8022A carefully crafted invalid TLS handshake can cause Apache T…
- CVE-2018-8023Apache Mesos can be configured to require authentication to …
- CVE-2018-8025CVE-2018-8025 describes an issue in Apache HBase that affect…
- CVE-2018-8026This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 t…
- CVE-2018-8027Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable …
- CVE-2018-8028An authenticated user can execute ALTER TABLE EXCHANGE PARTI…
- CVE-2018-8029In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.…
- CVE-2018-8030A Denial of Service vulnerability was found in Apache Qpid B…
Are you affected by CVE-2018-8024?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST