CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It affects Apache. Its EPSS score suggests a 29.2% probability of exploitation in the next 30 days.
CVE
CVE-2020-9480
Severity
CRITICAL
CVSS
9.8
EPSS
29.16%
Apache
Original NVD Description
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Related CVEs
Other vulnerabilities affecting the same vendor(s)