{"answers":{"affected":"4 open source packages ship an affected version, including org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-11770 exists.","fix":"No fix has been published for CVE-2018-11770 yet. Limit exposure of the affected software until one is available.","what":"CVE-2018-11770 is a medium-severity missing authorization vulnerability in Apache Spark, published on 13 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2018-11770 and fix it if it is affected.\n\nWhat it is: CVE-2018-11770 is a medium-severity missing authorization vulnerability in Apache Spark, published on 13 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-11770 exists.\n\nAffected packages and fixed versions:\n- org.apache.spark:spark-core_2.10 (Maven): affected from 1.0.0 up to 2.2.2; no fix listed\n- org.apache.spark:spark-core_2.10 (Maven): affected from 1.0.0 up to 2.2.2; no fix listed\n- org.apache.spark:spark-core_2.11 (Maven): affected from 1.0.0 up to 2.3.2; no fix listed\n- org.apache.spark:spark-core_2.11 (Maven): affected from 1.0.0 up to 2.3.2; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2018-11770/ (Markdown: https://insights.sbomify.com/CVE-2018-11770/index.md)","id":"CVE-2018-11770","markdown":"https://insights.sbomify.com/CVE-2018-11770/index.md","name":"CVE-2018-11770","record":{"aliases":["GHSA-w4r4-65mg-45x2"],"analysis":{"component_type":"server_software","fix_type":"configuration_change","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Spark","requires_auth":"low_privilege","summary":"Unauthenticated users can submit jobs via the REST API in Apache Spark standalone mode, potentially executing arbitrary code.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"spark","vendor":"apache"}],"cvss":{"score":4.2,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"description":"From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":"2017-12-12","github_poc":1,"max_poc_stars":1,"metasploit":1,"nuclei":0,"refs":[{"date":"2019-10-09T16:41:39Z","kind":"github_poc","ref":"https://github.com/ivanitlearning/CVE-2018-11770","stars":1,"title":"Python RCE exploit for Apache Spark rewritten from Metasploit module"},{"date":"2017-12-12","kind":"metasploit","ref":"exploit/linux/http/spark_unauth_rce","stars":null,"title":"Apache Spark Unauthenticated Command Execution"}],"tier":"weaponised"},"has_fix":false,"headline":"org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability","id":"CVE-2018-11770","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"missing_authorization","year":"2018"},"n_packages":4,"n_references":3,"next":{"headline":"Moderate severity vulnerability that affects org.apache.commons:commons-compress","id":"CVE-2018-11771"},"packages":[{"ecosystem":"Maven","fixed":[],"introduced":["1.0.0"],"last_affected":["2.2.2"],"package":"org.apache.spark:spark-core_2.10","purl":null,"source":"GHSA-w4r4-65mg-45x2"},{"ecosystem":"Maven","fixed":[],"introduced":["1.0.0"],"last_affected":["2.2.2"],"package":"org.apache.spark:spark-core_2.10","purl":"pkg:maven/org.apache.spark/spark-core_2.10","source":"GHSA-w4r4-65mg-45x2"},{"ecosystem":"Maven","fixed":[],"introduced":["1.0.0"],"last_affected":["2.3.2"],"package":"org.apache.spark:spark-core_2.11","purl":null,"source":"GHSA-w4r4-65mg-45x2"},{"ecosystem":"Maven","fixed":[],"introduced":["1.0.0"],"last_affected":["2.3.2"],"package":"org.apache.spark:spark-core_2.11","purl":"pkg:maven/org.apache.spark/spark-core_2.11","source":"GHSA-w4r4-65mg-45x2"}],"prev":{"headline":"Privilege escalation in Apache CouchDB","id":"CVE-2018-11769"},"products":["Apache Spark"],"published":"2018-08-13","related":[{"cvss_score":8.8,"headline":"Apache Spark Command Injection","id":"CVE-2022-33891","kev_date_added":"2023-03-07","published":"2022-07-18"},{"cvss_score":9.8,"headline":"Improper Authentication in Apache Spark","id":"CVE-2020-9480","kev_date_added":null,"published":"2020-06-23"},{"cvss_score":9.8,"headline":"Remote Code Execution in spark-core","id":"CVE-2018-17190","kev_date_added":null,"published":"2018-11-19"},{"cvss_score":9.1,"headline":"HTTP Request Smuggling in Netty","id":"CVE-2019-20445","kev_date_added":null,"published":"2020-01-29"},{"cvss_score":8.8,"headline":"Apache Spark: Spark History Server Code Execution Vulnerability","id":"CVE-2025-54920","kev_date_added":null,"published":"2026-03-14"},{"cvss_score":8.8,"headline":"Apache Spark: Shell command injection via Spark UI","id":"CVE-2023-32007","kev_date_added":null,"published":"2023-05-02"},{"cvss_score":7.8,"headline":"Apache Spark Deserialization of Untrusted Data vulnerability","id":"CVE-2017-12612","kev_date_added":null,"published":"2017-09-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-05","vendors":["Apache Software Foundation"]},"summary":"Unauthenticated users can submit jobs via the REST API in Apache Spark standalone mode, potentially executing arbitrary code.","url":"https://insights.sbomify.com/CVE-2018-11770/"}