Vulnerabilities > CVE-2018-1314 - Missing Authorization vulnerability in Apache Hive

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

apache

CWE-862

NVD

Published: 2018-11-08

Updated: 2024-11-21

Summary

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Hive 0.3.0 Apache Hive 0.4.0 Apache Hive 0.4.1 Apache Hive 0.5.0 Apache Hive 0.6.0 Apache Hive 0.7.0 Apache Hive 0.7.1 Apache Hive 0.8.0 Apache Hive 0.8.1 Apache Hive 0.9.0 Apache Hive 0.10.0 Apache Hive 0.11.0 Apache Hive 0.12.0 Apache Hive 0.13.0 Apache Hive 0.13.1 Apache Hive 0.14.0 Apache Hive 1.0.0 Apache Hive 1.0.1 Apache Hive 1.1.0 Apache Hive 1.1.1 Apache Hive 1.2.0 Apache Hive 1.2.1 Apache Hive 1.2.2 Apache Hive 2.0.0 Apache Hive 2.0.1 Apache Hive 2.1.0 Apache Hive 2.1.1 Apache Hive 2.2.0 Apache Hive 2.2.1 Apache Hive 2.3.0 Apache Hive 2.3.1 Apache Hive 2.3.2 Apache Hive 2.3.3 Apache Hive 3.0.0 Apache Hive 3.1.0	35

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References