CVE-2014-0228 Low severity vulnerability that affects org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service
LowCVSS 3.5
EPSS 3.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hive/hive(Maven) | < 0.13.1 | 0.13.1 |
| org.apache.hive/hive(Maven) | = 0.13.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | < 0.13.1 | 0.13.1 |
| org.apache.hive/hive-exec(Maven) | = 0.10.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | = 0.11.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | = 0.12.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | = 0.13.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | = 0.8.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | = 0.8.1 | No fix listed |
| org.apache.hive/hive-exec(Maven) | = 0.9.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | < 0.13.1 | 0.13.1 |
| org.apache.hive/hive-service(Maven) | = 0.10.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | = 0.11.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | = 0.12.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | = 0.13.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | = 0.8.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | = 0.8.1 | No fix listed |
| org.apache.hive/hive-service(Maven) | = 0.9.0 | No fix listed |
| apache hive | <= 0.13.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- mail-archives.apache.org
- packetstormsecurity.com exploit
- 20140612 CVE-2014-0228: Apache Hive Authorization vulnerability mailing-list
- [hive-user] 20140612 CVE-2014-0228: Apache Hive Authorization vulnerability mailing-list