CVE

CVE-2022-33891

Apache Spark Command Injection Vulnerability

Apache · Spark

Date added (CISA)

2023-03-07

Remediation due

2023-03-28

Known ransomware use

Not indicated

Remediation priority

P2 — past CISA due date

Description

Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.