Hive Authorizer Vulnerability in Apache Ranger Affects Data Security
CVE-2017-7677

5.9MEDIUM

Key Information:

Vendor
Apache
Status
Apache Ranger
Vendor
CVE Published:
14 June 2017

Summary

The Hive Authorizer in Apache Ranger, prior to version 0.7.1, fails to properly enforce RWX permissions when creating external hive tables. This oversight can permit unauthorized users to create tables and potentially lead to data leaks or manipulation within the system. Organizations utilizing Apache Ranger for managing data access in Hive environments should consider upgrading their installations to mitigate this vulnerability and ensure robust data security.

Affected Version(s)

Apache Ranger 0.5.x

Apache Ranger 0.6.x

Apache Ranger 0.7.0

References

http://www.securityfocus.com/bid/98961
vdb-entryx_refsource_BID
https://cwiki.apache.org/confluence/display/RANGER/Vulner...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.