CVE-2018-11804 json
Improper Input Validation in Apache Spark
published 2018-10-24 8 y ago modified 2026-06-17 4 mo ago also GHSA-62g2-m955-v383 , EUVD-2022-2689
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.7%
- EPSS 5.7% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.
Patch / fix
- apache spark 2.2.3, 2.3.3
Exploit prediction
5.70% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.spark:spark-core_2.11 | >=1.3.0, <=2.1.3 |
no fix listed |
| maven | org.apache.spark:spark-core_2.10 | >=1.3.0, <=2.1.3 |
no fix listed |
Affected products
- Apache Software Foundation Apache Spark
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
spark.apache.org
/security.html#CVE-2018-11804
web, mitigation, vendor-advisory
-
lists.apache.org
/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d%40%3Cdev.spark.apache.org%3E
mailing-list, web, third-party-advisory
-
securityfocus.com
/bid/105756
vdb-entry, broken-link, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-11804
advisory
-
github.com
/apache/spark
package
-
lists.apache.org
/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d@%3Cdev.spark.apache.org%3E
web
-
web.archive.org
/web/20200227103903/http://www.securityfocus.com/bid/105756
web
Sources
- CVE List CVE-2018-11804
- GitHub Advisory GHSA-62g2-m955-v383
- NVD CVE-2018-11804
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.