CVE-2023-22946

Katalog CVE

CVSS 9.9 · Critical EPSS 1,1%

Kerentanan Improper Privilege Management pada apache spark. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Rincian

Terbit di NVD

17 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv mailing list · advisory vendor