CVE-2018-9159 Information

Description

In Spark before 2.7.2 a remote attacker can read unintended static files via various representations of absolute or relative pathnames as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Reference

http://sparkjava.com/newsspark-272-released https://access.redhat.com/errata/RHSA-2018:2020 https://access.redhat.com/errata/RHSA-2018:2405 https://github.com/perwendel/spark/commit/030e9d00125cbd1ad759668f85488aba1019c668 https://github.com/perwendel/spark/commit/a221a864db28eb736d36041df2fa6eb8839fc5cd https://github.com/perwendel/spark/commit/ce9e11517eca69e58ed4378d1e47a02bd06863cc https://github.com/perwendel/spark/issues/981

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

NONE

Base Score

NONE

Base Severity

5.3