CNVD-2018-15548 — Vulnetix

CNVD-2018-15548 PUBLISHED

Apache Spark是美国阿帕奇（Apache）软件基金会的的一款支持非循环数据流和内存计算的大规模数据处理引擎。 Apache Spark 1.3.0及之后版本中存在安全漏洞，该漏洞源于standalone master或启用集群模式的Mesos master不仅公开了提交机制还公开了用于提交工作的REST API。攻击者可利用该漏洞未经身份验证运行驱动程序。

Affected Products

Vendor	Product	Versions
Apache Software Foundation	Apache Spark	1.3.0

Timeline

Jun 7, 2018 CVE Published
Nov 29, 2018 PoC Published
Feb 6, 2025 PoC Published
Feb 23, 2025 PoC Published
Feb 2, 2026 PoC Published

References

https://spark.apache.org/security.html#CVE-2018-11770 url
[dev] 20180813 CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication mailing-list
105097 vdb

Open in Interactive Console →