GitHub Advisoryadvisory · Maven

GHSA-w4x9-4f5x-8jj8 Low severity vulnerability that affects org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service

LOW Published 2018-11-21 Modified 2020-06-16 Official page ↗
Aliases
CVE-2014-0228
Ecosystem
Maven
Packages
org.apache.hive:hive, org.apache.hive:hive-exec, org.apache.hive:hive-service
Severity
Low
Weaknesses
CWE-284
Reviewed
2020-06-16

Affected packages

• Maven org.apache.hive:hive: < 0.13.1 → fixed in 0.13.1 • Maven org.apache.hive:hive-exec: < 0.13.1 → fixed in 0.13.1 • Maven org.apache.hive:hive-service: < 0.13.1 → fixed in 0.13.1

Description

Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.

Related

Alias · CVE (1)

  • CVE-2014-0228 Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References