{"id":"CVE-2020-9480","published":"2020-06-23T21:50:51Z","modified":"2024-08-04T10:26:16Z","title":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication…","vendor":"Apache Software Foundation","product":"Apache Spark","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Spark","versions":["Apache Spark 2.4.5 and earlier"]}],"description":{"text":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.2937,"percentile":0.98178,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-10","exploitedFirstSeen":"2024-05-10","ransomware":false,"evidence":[{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2020-9480","date":"2025-10-24"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://spark.apache.org/security.html#CVE-2020-9480","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b%40%3Cuser.spark.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2%40%3Cdev.spark.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d%40%3Ccommits.submarine.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b%40%3Ccommits.doris.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.spark:spark-parent_2.11","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"from":["GHSA-wgx7-jwwm-cgjv"],"provenance":"source"},{"ecosystem":"PyPI","package":"pyspark","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"from":["GHSA-wgx7-jwwm-cgjv","PYSEC-2020-95"],"provenance":"source"}],"advisories":[{"id":"GHSA-wgx7-jwwm-cgjv","url":"https://github.com/advisories/GHSA-wgx7-jwwm-cgjv","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.spark:spark-parent_2.11","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-wgx7-jwwm-cgjv","url":"https://github.com/advisories/GHSA-wgx7-jwwm-cgjv","severity":"CRITICAL","ecosystem":"PyPI","package":"pyspark","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0158","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0158","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-9480","name":"Apache Spark - Authentication Bypass","severity":"critical","path":"http/cves/2020/CVE-2020-9480.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9480.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-06-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-9480","provenance":"source"},{"date":"2024-05-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":59.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 905 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.64,"detail":"percentile 0.9818"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-1334","published":"2018-07-12","fixed":"2.2.2","kev":false},{"cve":"CVE-2018-11760","published":"2019-02-04","fixed":"2.3.2","kev":false},{"cve":"CVE-2019-10099","published":"2019-08-07","fixed":"2.3.3","kev":false,"link":{"from":"CVE-2019-10099","to":"CVE-2020-9480","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pyspark","fromFixed":"2.3.3","toFixed":"2.4.6","daysApart":321}]}},{"cve":"CVE-2020-9480","published":"2020-06-23","fixed":"2.4.6","kev":false},{"cve":"CVE-2021-38296","published":"2022-03-10","fixed":"3.1.3","kev":false},{"cve":"CVE-2022-33891","published":"2022-07-18","fixed":"3.2.2","kev":true},{"cve":"CVE-2023-32007","published":"2023-05-02","fixed":"3.2.2","kev":false}],"package":"PyPI:pyspark"}}