{"id":"CVE-2020-9480","published":"2020-06-23T21:50:51Z","modified":"2024-08-04T10:26:16Z","title":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication…","vendor":"Apache Software Foundation","product":"Apache Spark","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Spark","versions":["Apache Spark 2.4.5 and earlier"]}],"description":{"text":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.2937,"percentile":0.98174,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-10","exploitedFirstSeen":"2024-05-10","ransomware":false,"evidence":[{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2020-9480","date":"2025-10-24"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"GitHub - nautilus-aqua/Kinsing-Indication-of-Compromise: This repo contains indication of compromise of Kinsing threat actor that were collected over a period of few years","url":"https://otx.alienvault.com/pulse/67ba26921050c137f83c3b8d","created":"2025-02-22"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://spark.apache.org/security.html#CVE-2020-9480","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b%40%3Cuser.spark.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2%40%3Cdev.spark.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d%40%3Ccommits.submarine.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b%40%3Ccommits.doris.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.spark:spark-parent_2.11","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"from":["GHSA-wgx7-jwwm-cgjv"],"provenance":"source"},{"ecosystem":"PyPI","package":"pyspark","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"from":["GHSA-wgx7-jwwm-cgjv","PYSEC-2020-95"],"provenance":"source"}],"advisories":[{"id":"GHSA-wgx7-jwwm-cgjv","url":"https://github.com/advisories/GHSA-wgx7-jwwm-cgjv","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.spark:spark-parent_2.11","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-wgx7-jwwm-cgjv","url":"https://github.com/advisories/GHSA-wgx7-jwwm-cgjv","severity":"CRITICAL","ecosystem":"PyPI","package":"pyspark","vulnerableRanges":["<2.4.6"],"patched":["2.4.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0158","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0158","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-9480","name":"Apache Spark - Authentication Bypass","severity":"critical","path":"http/cves/2020/CVE-2020-9480.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9480.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-06-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-9480","provenance":"source"},{"date":"2024-05-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":60.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 902 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.63,"detail":"percentile 0.9817"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-1334","published":"2018-07-12","fixed":"2.2.2","kev":false},{"cve":"CVE-2018-11760","published":"2019-02-04","fixed":"2.3.2","kev":false},{"cve":"CVE-2019-10099","published":"2019-08-07","fixed":"2.3.3","kev":false,"link":{"from":"CVE-2019-10099","to":"CVE-2020-9480","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pyspark","fromFixed":"2.3.3","toFixed":"2.4.6","daysApart":321}]}},{"cve":"CVE-2020-9480","published":"2020-06-23","fixed":"2.4.6","kev":false},{"cve":"CVE-2021-38296","published":"2022-03-10","fixed":"3.1.3","kev":false},{"cve":"CVE-2022-33891","published":"2022-07-18","fixed":"3.2.2","kev":true},{"cve":"CVE-2023-32007","published":"2023-05-02","fixed":"3.2.2","kev":false}],"package":"PyPI:pyspark"}}