CVE-2020-9480: apache software foundation apache spark
Vulnerability summary
CVE-2020-9480 is a critical (CVSS 9.8) vulnerability in apache software foundation apache spark. EPSS estimates a 29.37% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities.
Timeline
- 23-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
CVSS metrics
6 scores · 3 sources · 3 versions- OSV · MavenEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
29.37%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 29.37% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- spark≤ 2.4.5
Apache software foundation1 product
- apache sparkApache Spark 2.4.5 and earlier
Oracle1 product
- business_intelligence5.5.0.0.0
Org.apache.spark1 product
- spark-parent_2.11< 2.4.6
PyPI1 product
- pyspark< 2.4.6
5 vendors · 5 products
