CVE-2018-8028 Apache Sentry may allow attacker to access/remove data from Sentry protected table
HighCVSS 8.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.sentry/sentry(Maven) | < 2.0.1 | 2.0.1 |
| org.apache.sentry/sentry(Maven) | = 1.7.0 | No fix listed |
| org.apache.sentry/sentry(Maven) | = 1.7.1 | No fix listed |
| org.apache.sentry/sentry(Maven) | = 1.8.0 | No fix listed |
| org.apache.sentry/sentry(Maven) | = 2.0.0 | No fix listed |
| apache sentry | < 2.0.1 | 2.0.1 |
| Apache Sentry | = Apache Sentry 2.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- cwiki.apache.org third-party-advisory
- github.com product
- github.com