Vulnerability Details : CVE-2018-11760
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Products affected by CVE-2018-11760
- cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-11760
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-11760
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:P/A:N |
3.9
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
1.8
|
3.6
|
NIST |
References for CVE-2018-11760
-
https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E
[spark-website] branch asf-site updated: CVE-2019-10099 - Pony Mail
-
http://www.securityfocus.com/bid/106786
Apache Spark CVE-2018-11760 Local Privilege Escalation VulnerabilityThird Party Advisory
-
https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E
CVE-2018-11760: Apache Spark local privilege escalation vulnerability - Pony MailMailing List;Vendor Advisory
Jump to