CVE-2018-1314 - In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query

Back Back to CVE browser

MEDIUM

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query

Published Nov 8, 2018

4.3

MEDIUM

CVSS 3.0

EPSS 1.99%

Description

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.

Affected products

Vendor Apache Software Foundation Product Apache Hive Default
n/a
- Version
  All versions of Hive including 2.3.3, 3.1.0 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Hive

n/a

Version	Status	Constraints
All versions of Hive including 2.3.3, 3.1.0 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (5)

http://www.securityfocus.com/bid/105884
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-jmf4-pq78-f8vj
Advisory
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E
x_refsource_MISC
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727@%3Cdev.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2018-1314

Link	Providers	Tags
http://www.securityfocus.com/bid/105884		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-jmf4-pq78-f8vj		Advisory
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E		x_refsource_MISC
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727@%3Cdev.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2018-1314