PT-2020-20691 · Apache · Apache Spark

Published 2020-06-23 · Updated 2025-10-01 · CVE-2020-9480

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Spark versions 2.4.5 and earlier

Description A specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key, when authentication is enabled via a shared secret. This can be leveraged to execute shell commands on the host machine. This issue does not affect Spark clusters using other resource managers, such as YARN or Mesos.

Recommendations For Apache Spark versions 2.4.5 and earlier, consider disabling the authentication feature until a patch is available, or restrict access to the master to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

BDU:2025-09903

BIT-SPARK-2020-9480

CVE-2020-9480

GHSA-WGX7-JWWM-CGJV

PYSEC-2020-95

Affected Products

Apache Spark

References · 24

• 🔥 https://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d@%3Ccommits.submarine.apache.org%3E · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9480 · Security Note
• https://bdu.fstec.ru/vul/2025-09903 · Security Note
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://spark.apache.org/security.html#CVE-2020-9480 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-95 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-spark-2020-9480 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9480 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wgx7-jwwm-cgjv · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2020-95.yaml · Note
• https://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b@%3Ccommits.doris.apache.org%3E · Note
• https://t.me/cvenotify/6809 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1973266677094822366 · Twitter Post
• https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b@%3Cuser.spark.apache.org%3E · Note
• https://vuldb.com/?id.173490 · Note