CVE-2023-22946

CVE-2023-22946 is a critical privilege escalation vulnerability affecting Apache Spark versions prior to 3.4.0. It allows a malicious application, submitted via spark-submit and specifying a 'proxy-user', to execute code with the privileges of the submitting user by providing malicious configuration classes on the classpath, impacting systems like Apache Livy. With a CVSS score of 9.9 (Critical), this network-exploitable vulnerability has low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.