CVE-2018-8024 json
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL
published 2018-07-12 8 y ago modified 2026-09-10 1 mo ago also EUVD-2019-0376 , GHSA-8cw6-5qvp-q3wj
- cvss
- 5.4
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.3%
- EPSS 5.3% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.
Patch / fix
- maven org.apache.spark:spark-core_2.10 2.1.3, 2.2.2
- maven org.apache.spark:spark-core_2.11 2.1.3, 2.2.2, 2.3.1
- apache spark 2.1.3, 2.2.2, 2.3.1
- org.apache.spark spark-core_2.10 2.1.3, 2.2.2
- org.apache.spark spark-core_2.11 2.1.3, 2.2.2, 2.3.1
Exploit prediction
5.29% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Apache Spark UI - Cross-Site Scripting nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.9 | AV:N/AC:M/Au:S/C:P/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.spark:spark-core_2.10 | >=2.1.0, <2.1.3 >=2.2.0, <2.2.2 |
2.1.3 2.2.2 |
| maven | org.apache.spark:spark-core_2.11 | >=2.1.0, <2.1.3 >=2.2.0, <2.2.2 >=2.3.0, <2.3.1 |
2.1.3 2.2.2 2.3.1 |
Affected products
- Apache Software Foundation Apache Spark
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
spark.apache.org
/security.html#CVE-2018-8024
web, mitigation, vendor-advisory
-
lists.apache.org
/thread.html/5f241d2cda21cbcb3b63e46e474cf5f50cce66927f08399f4fab0aba%40%3Cdev.spark.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2018-8024
advisory
-
github.com
/advisories/GHSA-8cw6-5qvp-q3wj
advisory
-
lists.apache.org
/thread.html/5f241d2cda21cbcb3b63e46e474cf5f50cce66927f08399f4fab0aba@%3Cdev.spark.apache.org%3E
web
Sources
- CVE List CVE-2018-8024
- GitHub Advisory GHSA-8cw6-5qvp-q3wj
- NVD CVE-2018-8024
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Add Apache Spark fixed versions and remove Firefox as an affected component.