CVE-2018-17190 Vulnerability Details

  /     /     /  

CVE-2018-17190 Metadata Quick Info

CVE Published: 19/11/2018 | CVE Updated: 05/08/2024 | CVE Year: 2018
Source: apache | Vendor: Apache Software Foundation | Product: Apache Spark
Status : PUBLISHED

---

CVE-2018-17190 Description

In all versions of Apache Spark, its standalone resource manager accepts code to execute on a \'master\' host, that then runs that code on \'worker\' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: Arbitrary Code Execution
Source: Apache Software Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).