GHSA-jmf4-pq78-f8vjMediumCVSS 4.3

Moderate severity vulnerability that affects org.apache.hive:hive-jdbc

Published
November 21, 2018
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-1314 →

📋 Description

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.

🎯 Affected products2

  • maven/org.apache.hive:hive-jdbc:< 2.3.4
  • maven/org.apache.hive:hive-jdbc:>= 3.0.0, < 3.1.1

🔗 References (4)