What is CVE-2023-32007?

CVE-2023-32007 is a vulnerability in Apache Software Foundation Spark, classified under Command Injection. Published 2023-05-02.

Is CVE-2023-32007 known to be exploited?

27 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Apache Software Foundation Spark

CVE-2023-32007

** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify th…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.923 (99.7th percentile) — read the EPSS interpretation.

Affected products

Apache Software Foundation Spark — versions 3.1.1

Weakness classification (CWE)

CWE-77 — Command Injection

Public proof-of-concept exploits

References

www.cve.org/CVERecord (related)
spark.apache.org/security.html (vendor-advisory)
lists.apache.org/thread/poxgnxhhnzz735kr1wos366l5vdbb0nv (vendor-advisory)
www.openwall.com/lists/oss-security/2023/05/02/1

Frequently asked questions

What is CVE-2023-32007?: CVE-2023-32007 is a vulnerability in Apache Software Foundation Spark, classified under Command Injection. Published 2023-05-02.
Is CVE-2023-32007 known to be exploited?: 27 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.