Riskcovery

CVE-2018-8024

State
Published
Severity
Not scored
Published
Jul 12, 2018
Updated
Sep 17, 2024
Reserved
Mar 9, 2018

Read the record on cve.org

Description

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Apache SparkApache Software Foundation
  • 1.0.0 to 2.1.2Affected
  • 2.2.0 to 2.2.1Affected
  • 2.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.