GitHub Advisoryadvisory · Maven

GHSA-rxmr-c9jm-7mm8 Exposure of Sensitive Information to an Unauthorized Actor in Apache hive

LOW Published 2018-11-21 Modified 2024-03-04 Official page ↗
Aliases
CVE-2018-1284
Ecosystem
Maven
Packages
org.apache.hive:hive, org.apache.hive:hive-exec, org.apache.hive:hive-service
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• Maven org.apache.hive:hive: >= 0.6.0, < 2.3.3 → fixed in 2.3.3 • Maven org.apache.hive:hive-exec: >= 0.6.0, < 2.3.3 → fixed in 2.3.3 • Maven org.apache.hive:hive-service: >= 0.6.0, < 2.3.3 → fixed in 2.3.3

Description

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if hive.server2.enable.doAs=false.

Related

Alias · CVE (1)

  • CVE-2018-1284 In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References