CVE-2023-22946

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

• CWE-269

• https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gvMailing List, Vendor Advisory
• https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gvMailing List, Vendor Advisory

Published

Apr 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22940In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.…5.7
• CVE-2023-22941In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.…7.5
• CVE-2023-22942In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.…4.3
• CVE-2023-22943In Splunk Add-on Builder (AoB) versions below 4.1.2 and the …5.3
• CVE-2023-22944Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-22945In the GrowthExperiments extension for MediaWiki through 1.3…4.3
• CVE-2023-22947Insecure folder permissions in the Windows installation path…7.3
• CVE-2023-22948An issue was discovered in TigerGraph Enterprise Free Editio…4.9
• CVE-2023-22949An issue was discovered in TigerGraph Enterprise Free Editio…4.9
• CVE-2023-2295A vulnerability was found in the libreswan library. This sec…7.5
• CVE-2023-22950An issue was discovered in TigerGraph Enterprise Free Editio…6.5
• CVE-2023-22951An issue was discovered in TigerGraph Enterprise Free Editio…8.8