CVE-2022-33891
HighExploitedPublic exploitApache Spark UI can allow impersonation if ACLs enabled
Published Jul 19, 2022 · Updated Sep 8, 2026 · Also known as BIT-spark-2022-33891, GHSA-4x9r-j582-cgr8, PYSEC-2022-236
Key Facts
Patch immediately- CVE-2022-33891 is a high-severity vulnerability (CVSS 8.7 v4) affecting Spark (Apache), org.apache.spark:spark-parent_2.12 (pypi), pyspark (pypi) and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 21, 2022. Public exploit code is available.
- EPSS estimates a 93% probability of exploitation in the next 30 days.
- Fixed versions are available, including Spark <=3.0.3, Spark 2.2.3-5.12.1, Spark 3.0.4.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v4
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A
EPSS (30-day exploit likelihood)
93%
Higher than 99.8% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2022-33891 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Mar 7, 2023 | Mar 28, 2023 | Not reported |
| Industry KEV feed | Dec 21, 2022 | Mar 28, 2023 | Not reported |
| CIRCL KEV | Mar 7, 2023 | Mar 28, 2023 | Not reported |
| ENISA EUVD | Mar 7, 2023 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
77 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SparkApache | >= 3.0.3 and earlier | 3.0.3 |
| org.apache.spark:spark-parent_2.12pypi | See advisory | 3.2.2 |
| pysparkpypi | See advisory | 3.2.2 |
| org.apache.spark:spark-core_2.11seal | See advisory | 2.3.2+sp2p2 |
| seal-pysparkseal | See advisory | 2.4.8+sp999 |
Patched Releases
Spark
<=3.0.3, 2.2.3-5.12.1, 3.0.4, 3.1.3, 3.2.2
openstack-barbican
7.0.1~dev24-3.17.1
openstack-barbican-api
7.0.1~dev24-3.17.1
openstack-barbican-keystone-listener
7.0.1~dev24-3.17.1
openstack-barbican-retry
7.0.1~dev24-3.17.1
openstack-barbican-worker
7.0.1~dev24-3.17.1
openstack-heat-gbp
14.0.1~dev5-3.12.1
openstack-horizon-plugin-gbp-ui
14.0.1~dev6-3.15.1
openstack-neutron
13.0.8~dev209-3.43.1
openstack-neutron-dhcp-agent
13.0.8~dev209-3.43.1
openstack-neutron-gbp
14.0.1~dev52-3.37.1
openstack-neutron-ha-tool
13.0.8~dev209-3.43.1
openstack-neutron-l3-agent
13.0.8~dev209-3.43.1
openstack-neutron-linuxbridge-agent
13.0.8~dev209-3.43.1
openstack-neutron-macvtap-agent
13.0.8~dev209-3.43.1
openstack-neutron-metadata-agent
13.0.8~dev209-3.43.1
openstack-neutron-metering-agent
13.0.8~dev209-3.43.1
openstack-neutron-openvswitch-agent
13.0.8~dev209-3.43.1
openstack-neutron-server
13.0.8~dev209-3.43.1
org.apache.spark:spark-core_2.11
2.3.2+sp2p2
org.apache.spark:spark-parent_2.12
3.2.2
pyspark
2.4.8+sp999, 3.1.3, 3.2.2
python-barbican
7.0.1~dev24-3.17.1
python-heat-gbp
14.0.1~dev5-3.12.1
python-horizon-plugin-gbp-ui
14.0.1~dev6-3.15.1
Timeline
Publicly disclosed
Jul 19, 2022
Added to Industry KEV feed
Dec 21, 2022
Added to CISA KEV
Mar 7, 2023
Added to CIRCL KEV
Mar 7, 2023
Added to ENISA EUVD
Mar 7, 2023
Last updated
Sep 8, 2026
Weakness Type
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryhttps://bugzilla.suse.com/1203873
- advisoryhttps://bugzilla.suse.com/1204326
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33891.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2022-33891
FAQ
Common Questions.
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable.
Affected: Spark (Apache) versions >= 3.0.3 and earlier; org.apache.spark:spark-parent_2.12 (pypi); pyspark (pypi), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 21, 2022.
Yes. It was added on Mar 7, 2023 with a federal remediation due date of Mar 28, 2023.
Public exploit code is available.
Fixed versions are available, including Spark <=3.0.3, Spark 2.2.3-5.12.1, Spark 3.0.4.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2022-33891 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo