Read the docs
TI-2018-05801 Aliases CVE-2018-8024GHSA-8cw6-5qvp-q3wj

Information disclosure in Apache Spark

Priority LOW 33CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.

Why it matters now

EPSS 0.05294 92nd percentileScored 2026-11-07
Fix Fixed org.apache.spark:spark-core_2.10 (Maven): 2.1.3, 2.2.2org.apache.spark:spark-core_2.11 (Maven): 2.1.3, 2.2.2, 2.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Spark1.0.0 to 2.1.2; 2.2.0 to 2.2.1; 2.3.0—No fix listedCNA
—org.apache.spark:spark-core_2.10 (Maven)2.1.0 to before 2.1.32.1.3Patch availableGHSA-8cw6-5qvp-q3wj
—org.apache.spark:spark-core_2.10 (Maven)2.2.0 to before 2.2.22.2.2Patch availableGHSA-8cw6-5qvp-q3wj
—org.apache.spark:spark-core_2.11 (Maven)2.1.0 to before 2.1.32.1.3Patch availableGHSA-8cw6-5qvp-q3wj
—org.apache.spark:spark-core_2.11 (Maven)2.2.0 to before 2.2.22.2.2Patch availableGHSA-8cw6-5qvp-q3wj
—org.apache.spark:spark-core_2.11 (Maven)2.3.0 to before 2.3.12.3.1Patch availableGHSA-8cw6-5qvp-q3wj
  • Apache Spark VendorApache Affected 1.0.0 to 2.1.2; 2.2.0 to 2.2.1; 2.3.0 Fixed in — No fix listed CNA
  • org.apache.spark:spark-core_2.10 (Maven) Vendor— Affected 2.1.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-8cw6-5qvp-q3wj
  • org.apache.spark:spark-core_2.10 (Maven) Vendor— Affected 2.2.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-8cw6-5qvp-q3wj
  • org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected 2.1.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-8cw6-5qvp-q3wj
  • org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected 2.2.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-8cw6-5qvp-q3wj
  • org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-8cw6-5qvp-q3wj

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*2.1.0 – 2.1.2; 2.2.0 – 2.2.1VulnerableApache
cpe:2.3:a:apache:spark:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableApache
cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*not specified by NVDVulnerableMozilla
  • cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions 2.1.0 – 2.1.2; 2.2.0 – 2.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Apache
  • cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Mozilla

Remediation

  • Fix · GHSA-8cw6-5qvp-q3wj org.apache.spark:spark-core_2.10 (Maven) Fixed in 2.1.3 Advisory →
  • Fix · GHSA-8cw6-5qvp-q3wj org.apache.spark:spark-core_2.10 (Maven) Fixed in 2.2.2 Advisory →
  • Fix · GHSA-8cw6-5qvp-q3wj org.apache.spark:spark-core_2.11 (Maven) Fixed in 2.1.3 Advisory →
  • Fix · GHSA-8cw6-5qvp-q3wj org.apache.spark:spark-core_2.11 (Maven) Fixed in 2.2.2 Advisory →
  • Fix · GHSA-8cw6-5qvp-q3wj org.apache.spark:spark-core_2.11 (Maven) Fixed in 2.3.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8024
  2. 2026-10-03 Alias added: GHSA-8cw6-5qvp-q3wj

References

Advisory 3

Other 2

  • TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
  • TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences