Vulnerability Database

289,689

Total vulnerabilities in the database

CVE-2018-11760

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.

CVSS v3:

  • Severity: Medium
  • Score: 5.5
  • AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

  • Severity: Low
  • Score: 2.1
  • AV:L/AC:L/Au:N/C:N/I:P/A:N

No CWE or OWASP classifications available.

Software From Fixed in
apache / spark 1.0.2 1.6.3.x
apache / spark 2.0.0 2.0.2.x
apache / spark 2.1.0 2.1.3.x
apache / spark 2.3.0 2.3.1.x
apache / spark 2.2.0 2.2.2.x
pyspark 2.3.0 2.3.2
pyspark 1.0.2 2.2.3