CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2022-07-18
Apache Spark UI Remote Command Injection Vulnerability via ACL Impersonation (CVE-2022-33891)
[Affected Scope] Apache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1
[Impact] Remote attackers can execute arbitrary OS shell commands with the privileges of the Spark process via crafted HTTP requests
[Mitigation] Immediately upgrade Apache Spark to versions 3.1.3, 3.2.2, 3.3.0 or later, or disable the spark.acls.enable configuration