Improper Privilege Management in Apache Spark - CVE-2023-22946

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU78721

Improper Privilege Management in Apache Spark - CVE-2023-22946

Published: July 27, 2023


Vulnerability identifier: #VU78721
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-22946
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management. A local user can send specially crafted configuration-related classes on the classpath and exploit this vulnerability to execute arbitrary code with the privileges of the submitting user.


Affected software

Apache Spark
Cloudera Observability with IBM
Oracle Business Intelligence Enterprise Edition
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle Financial Services Model Management and Governance
QRadar User Behavior Analytics
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Robotic Process Automation

How to mitigate CVE-2023-22946

Install updates from vendor's website.

Apache Spark - update to 3.4.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Cloud Pak for Watson AIOps - update to 4.1
QRadar User Behavior Analytics - update to 4.1.16
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
IBM Robotic Process Automation - addressed in versions 21.0.7.8, 23.0.9
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.8, 23.0.9

External References

Related Security Bulletins