CVE-2014-0228

Currently unrated

Key Information:

Vendor
Apache
Status
Hive
Vendor
CVE Published:
16 November 2014

Summary

Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.

References

http://mail-archives.apache.org/mod_mbox/hive-user/201406...
mailing-listx_refsource_MLIST
http://packetstormsecurity.com/files/127091/Apache-Hive-0...
x_refsource_MISC
http://www.securityfocus.com/archive/1/532418/100/0/threaded
mailing-listx_refsource_BUGTRAQ

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.