Apache Hive Authorization Flaw Allows Unauthorized Data Access

CVE-2014-0228

Summary

Apache Hive, a popular data warehousing tool built on top of Hadoop, is subject to a critical authorization flaw found in versions before 0.13.1. In SQL standards-based authorization mode, the system fails to accurately enforce file permissions for import and export actions. This oversight enables remote authenticated users to exploit the vulnerability by crafting specific URIs, potentially gaining unauthorized access to sensitive information. Organizations utilizing affected versions of Apache Hive must address this vulnerability promptly to secure their data and prevent unauthorized information disclosures.

References