CVE-2023-32007 is a critical vulnerability in Apache Spark, specifically affecting unsupported versions where ACLs are enabled in the Spark UI. It allows an authenticated attacker to impersonate other users, leading to arbitrary shell command execution as the user running Spark. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. While the vulnerability is not actively exploited and no public exploit code is available, its high EPSS score suggests a significant potential for future exploitation. Users are strongly advised to upgrade to a supported version of Apache Spark, such as 3.4.0, as this vulnerability impacts end-of-life products.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.0.3CPE matchmatch criteria | cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* | ||
>= 3.1.1, <= 3.1.3CPE matchmatch criteria | cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* | ||
>= 3.2.0, <= 3.2.1CPE matchmatch criteria | cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* | ||
>= 3.1.1, < 3.2.2CPE match | cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.