CVE-2018-1314

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.

Published: Nov 8, 2018
Updated: May 9, 2024
CVE: CVE-2018-1314
GHSA: GHSA-jmf4-pq78-f8vj
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-862

Affected Software
References

Software	From	Fixed in
apache / hive	-	2.3.3.x
apache / hive	3.0.0	3.1.0.x
org.apache.hive / hive-jdbc	-	2.3.4
org.apache.hive / hive-jdbc	3.0.0	3.1.1

http://www.securityfocus.com/bid/105884
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E

Vulnerability Database

CVE-2018-1314

Deep Security Visibility Without the Complexity