CVE-2016-0760 Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builti...
HighCVSS 8.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache sentry | = 1.5.1 | No fix listed |
| apache sentry | = 1.6.0 | No fix listed |
References
- [sentry-dev] 20160804 CVE-2016-0760: Hive builtin functions "reflect", "reflect2", and "java_method" are not blocked in Apache Sentry mailing-list vendor-advisory
- 92328 third-party-advisory vdb-entry