CVE-2014-0228

Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.

Score

CVSS 2.0 3.5 Low

Status

Modified - secalert@redhat.com

Published

2014-11-16

Last modified

2024-08-06

Weaknesses

CWE-284

Affected products

• Hive (Apache)

References

• http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g%4…
• http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html
• http://www.securityfocus.com/archive/1/532418/100/0/threaded