[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTvPH6q9me3KWtM0JNcIGV2Txvd67ukUv5240TSo4v-M":3,"g5a-risk:CVE-2020-9480":143},{"success":4,"data":5,"meta":141},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":40,"epssPercentile":27,"epssTimeSeries":41,"severity":42,"affectedProducts":43,"affectedProductsCount":54,"references":55,"referencesCount":79,"weaknesses":80,"weaknessesCount":89,"isActivelyExploited":90,"cisaInfo":27,"otxData":27,"relatedBlogPosts":91,"seoMetadata":92,"configurations":117,"relatedVendorCves":132,"notableEvents":133},"CVE-2020-9480","What is CVE-2020-9480?","In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).","In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secre...","2020-06-23T22:15:14.137","2023-11-07T03:26:54.673",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":27,"CVSSMetricV2":30,"CVSSMetricV40":27},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":25,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.9,[31],{"Source":17,"Type":18,"CVSSData":32,"BaseSeverity":25,"ExploitabilityScore":38,"ImpactScore":39,"ACInsufInfo":27,"ObtainAllPrivilege":27,"ObtainUserPrivilege":27,"ObtainOtherPrivilege":27,"UserInteractionRequired":27},{"Version":33,"VectorString":34,"AccessVector":21,"AccessComplexity":35,"Authentication":23,"ConfidentialityImpact":36,"IntegrityImpact":36,"AvailabilityImpact":36,"BaseScore":37,"BaseSeverity":27,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:C\u002FI:C\u002FA:C","MEDIUM","COMPLETE",9.3,8.6,10,0.2937,[40,40,40,40,40,40,40],"Critical",[44,49],{"vendor":45,"product":46,"version":47,"criteria":48,"vulnerable":4},"apache","spark","*","cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",{"vendor":50,"product":51,"version":52,"criteria":53,"vulnerable":4},"oracle","business_intelligence","5.5.0.0.0","cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*",2,[56,60,63,66,69,73],{"url":57,"source":58,"tags":59},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b%40%3Cuser.spark.apache.org%3E","Apache",[],{"url":61,"source":58,"tags":62},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b%40%3Ccommits.doris.apache.org%3E",[],{"url":64,"source":58,"tags":65},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d%40%3Ccommits.submarine.apache.org%3E",[],{"url":67,"source":58,"tags":68},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Free9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2%40%3Cdev.spark.apache.org%3E",[],{"url":70,"source":58,"tags":71},"https:\u002F\u002Fspark.apache.org\u002Fsecurity.html#CVE-2020-9480",[72],"Vendor Advisory",{"url":74,"source":75,"tags":76},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002FcpuApr2021.html","Oracle",[77,78],"Patch","Third Party Advisory",6,[81],{"id":82,"name":83,"description":84,"extendedDescription":85,"status":86,"abstraction":87,"structure":88},"CWE-306","Missing Authentication for Critical Function","The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","","Draft","Base","Simple",1,false,[],{"title":93,"metaDescription":94,"keywords":95,"canonicalUrl":96,"structuredData":97},"What is CVE-2020-9480? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-9480, a critical severity cyber security vulnerability from 2020. In Apache Spark 2.4.5 and earlier, a standalone resource...","CVE-2020-9480, CVE-2020-9480 vulnerability, CVE-2020-9480 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, apache security, oracle security, spark vulnerability, business_intelligence vulnerability","\u002Fwhat-is\u002Fcve-2020-9480",{"@context":98,"@type":99,"headline":93,"description":94,"datePublished":10,"dateModified":11,"author":100,"publisher":104,"about":108,"mainEntityOfPage":112,"articleSection":115,"keywords":116},"https:\u002F\u002Fschema.org","TechArticle",{"@type":101,"name":102,"url":103},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":101,"name":102,"url":103,"logo":105},{"@type":106,"url":107},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":109,"name":6,"description":110,"additionalType":111},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":113,"@id":114},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-9480","Cybersecurity","CVE-2020-9480, CVE-2020-9480 vulnerability, CVE-2020-9480 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[118,126],{"Operator":27,"Negate":27,"Nodes":119},[120],{"Operator":121,"Negate":27,"CPEMatch":122},"OR",[123],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":124,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":125},"0CFB1ECF-C94D-4EDD-9EBD-9B60803D4125","2.4.5",{"Operator":27,"Negate":27,"Nodes":127},[128],{"Operator":121,"Negate":27,"CPEMatch":129},[130],{"Vulnerable":4,"Criteria":53,"MatchCriteriaID":131,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"D40AD626-B23A-44A3-A6C0-1FFB4D647AE4",[],[134],{"id":135,"eventType":136,"eventTime":137,"details":138,"label":139,"color":140},"9d24cdcb-119b-41b9-b1e2-e39b73eef409","LOW_EPSS_DELTA","2026-06-16T04:05:46.216463+00:00","Daily EPSS score decreased by 0.591 on 2023-12-30","EPSS Score Decreased","green",{"lastModified":11,"cacheTime":142,"version":33},1792364762261,{"score":144,"band":145,"action":146,"scoredAt":147},61,"Medium","Plan remediation","2026-10-16T06:48:52.013634+00:00"]