Is CVE-2022-33891 actively exploited?

Yes. CVE-2022-33891 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-33891 be exploited remotely?

The attack vector of CVE-2022-33891 has not been classified yet.

What is the CVSS score of CVE-2022-33891?

CVE-2022-33891 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2022-33891

HIGHCISA KEVIN THE WILD

CVE-2022-33891

Published: March 7, 2023

EPSS:93.51%probability of exploitation in 30 daysPercentile:99.8th

Official Description

Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.

NVD Source

CISA KEV Advisory

Apache Spark Command Injection Vulnerability

Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.

Added to KEV: 2023-03-07Federal patch deadline: 2023-03-28

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This vulnerability in Apache Spark's User Interface allows for command injection when Access Control Lists (ACLs) are enabled. Given its high EPSS score of 0.93513 and inclusion in CISA's KEV, this flaw is highly likely to be exploited and poses a significant risk. System administrators should prioritize addressing this vulnerability.

Active exploitation of this vulnerability has been observed in the wild. The nature of command injection typically implies remote exploitability, especially within a UI context.

Recommended Action

Administrators should apply available patches or upgrades for Apache Spark to address this command injection vulnerability. Reviewing and strengthening ACL configurations may also help reduce risk.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-33891 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2022-33891 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.