Main
Vulnerability Database
Exploits
ID:10257 - Exploit for Improper Authentication in Apache Spark - CVE-2020-9480
ID:10257 - Exploit for Improper Authentication in Apache Spark - CVE-2020-9480
Published: July 26, 2024
Vulnerability identifier: #VU29536
Vulnerability risk: Medium
CVE-ID: CVE-2020-9480
CWE-ID: CWE-287
Exploitation vector: Remote access
Vulnerable software:
Apache Spark
Apache Spark
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in when processing authentication requests on Apache Spark master configured to require authentication (spark.authenticate) via a shared secret. A remote non-autenticated attacker can send a specially crafted RPC request without the shared key, bypass authentication process and start application resources on a Spark cluster.
Remediation
Install updates from vendor's website.