// For flags

CVE-2018-8024

 

Severity Score

5.4
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.

En Apache Spark versión 2.1.0 hasta 2.1.2, versión 2.2.0 hasta 2.2.1 y versión 2.3.0, es posible que un usuario malicioso construya una dirección URL que apunte a las páginas de información de trabajo y etapa de la Interfaz de Usuario del clúster Spark, y si un usuario puede ser engañado para que acceda a la dirección URL, puede ser usado para causar que el script se ejecute y exponga información de la vista del usuario de la IU de Spark. Mientras que algunos navegadores como las versiones recientes de Chrome y Safari son capaces de bloquear este tipo de ataque, las versiones actuales de Firefox (y posiblemente otros) no lo hacen.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-03-09 CVE Reserved
  • 2018-07-12 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Spark
Search vendor "Apache" for product "Spark"
 >= 2.1.0 <= 2.1.2
Search vendor "Apache" for product "Spark" and version " >= 2.1.0 <= 2.1.2"
-
Affected
Apache
Search vendor "Apache"
 Spark
Search vendor "Apache" for product "Spark"
 >= 2.2.0 <= 2.2.1
Search vendor "Apache" for product "Spark" and version " >= 2.2.0 <= 2.2.1"
-
Affected
Apache
Search vendor "Apache"
 Spark
Search vendor "Apache" for product "Spark"
 2.3.0
Search vendor "Apache" for product "Spark" and version "2.3.0"
-
Affected
Mozilla
Search vendor "Mozilla"
 Firefox
Search vendor "Mozilla" for product "Firefox"
--
Affected