Search for vulnerabilities
Vulnerability details: VCID-rpye-3x95-aaah
Vulnerability ID VCID-rpye-3x95-aaah
Aliases BIT-2023-22946
BIT-spark-2023-22946
CVE-2023-22946
GHSA-329j-jfvr-rhr6
PYSEC-0000-CVE-2023-22946
PYSEC-2023-44
Summary Apache Spark vulnerable to Improper Privilege Management
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-269 Improper Privilege Management
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
System Score Found at
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.0037 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.0037 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
epss 0.0058 https://api.first.org/data/v1/epss?cve=CVE-2023-22946
cvssv3.1 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-329j-jfvr-rhr6
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-329j-jfvr-rhr6
cvssv3.1 8.8 https://github.com/apache/spark
generic_textual HIGH https://github.com/apache/spark
cvssv3.1 9.9 https://github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a
generic_textual CRITICAL https://github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a
cvssv3.1 9.9 https://github.com/apache/spark/pull/39474
generic_textual CRITICAL https://github.com/apache/spark/pull/39474
cvssv3.1 9.9 https://github.com/apache/spark/pull/41428
generic_textual CRITICAL https://github.com/apache/spark/pull/41428
cvssv3.1 9.9 https://github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a
generic_textual CRITICAL https://github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a
cvssv3.1 9.9 https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml
cvssv3.1 9.9 https://issues.apache.org/jira/browse/SPARK-41958
generic_textual CRITICAL https://issues.apache.org/jira/browse/SPARK-41958
cvssv3.1 9.9 https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
generic_textual CRITICAL https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
cvssv3 9.9 https://nvd.nist.gov/vuln/detail/CVE-2023-22946
cvssv3.1 9.9 https://nvd.nist.gov/vuln/detail/CVE-2023-22946
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-22946
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/spark
https://github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a
https://github.com/apache/spark/pull/39474
https://github.com/apache/spark/pull/41428
https://github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a
https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml
https://issues.apache.org/jira/browse/SPARK-41958
https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
CVE-2023-22946 https://nvd.nist.gov/vuln/detail/CVE-2023-22946
GHSA-329j-jfvr-rhr6 https://github.com/advisories/GHSA-329j-jfvr-rhr6
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/spark
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/apache/spark/pull/39474
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/apache/spark/pull/41428
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://issues.apache.org/jira/browse/SPARK-41958
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-22946
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-22946
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.38969
EPSS Score 0.00089
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.