CVEvulnerability
CVE-2014-0228
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-11-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-284
Description
Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
Affected configurations
• apache hive (<= 0.13.0)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g%40mail.gmail.com%3E mail-archives.apache.org
- http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html packetstormsecurity.com
- http://www.securityfocus.com/archive/1/532418/100/0/threaded www.securityfocus.com
- http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g%40mail.gmail.com%3E mail-archives.apache.org
- http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html packetstormsecurity.com
- http://www.securityfocus.com/archive/1/532418/100/0/threaded www.securityfocus.com