CVE-2018-11804

CWE-20 — Improper Input Validation5 documents5 sources
Severity
7.5HIGH
EPSS
0.7%
top 27.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache SparkApache Spark
Timeline
PublishedOct 24
Latest updateMay 14

Description

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only de…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDapache/spark1.3.0 — 2.2.3+1
▶Mavenorg.apache.spark:spark-core_2.101.3.0 — 2.1.3
▶Mavenorg.apache.spark:spark-core_2.111.3.0 — 2.1.3

🔴Vulnerability Details

3
GHSA
Improper Input Validation in Apache Spark↗2022-05-14
▶
OSV
Improper Input Validation in Apache Spark↗2022-05-14
▶
CVEList
CVE-2018-11804: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation↗2018-10-24
▶

📋Vendor Advisories

1
Apache
Apache spark: CVE-2018-11804↗
▶
CVE-2018-11804 (HIGH CVSS 7.5) | Spark's Apache Maven-based build in | cvebase.io