GitHub Advisoryadvisory · Maven

GHSA-vjr2-wpfh-5r9p Apache Ranger Hive Plugin missing permissions check

HIGH Published 2023-05-05 Modified 2023-05-11 Official page ↗
Aliases
CVE-2021-40331
Ecosystem
Maven
Packages
org.apache.ranger:ranger-hive-plugin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-732
Reviewed
2023-05-05

Affected packages

• Maven org.apache.ranger:ranger-hive-plugin: >= 2.0.0, < 2.4.0 → fixed in 2.4.0

Description

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.

Related

Alias · CVE (1)

  • CVE-2021-40331 An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References