Low severity vulnerability that affects org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service
Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0228US | low3.5 | — | ||
Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remot… | ||||
02
references
External citations — patches, advisories, analysis.
- http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g@mail.gmail.com%3EWEB
- http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.htmlWEB
- http://www.securityfocus.com/archive/1/532418/100/0/threadedWEB
- https://github.com/advisories/GHSA-w4x9-4f5x-8jj8ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2014-0228ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan