Authentication Flaw in Apache Impala Allows Query Data Manipulation
CVE-2018-11785

6.5MEDIUM

Key Information:

Vendor
Apache
Status
Apache Impala
Vendor
CVE Published:
24 October 2018

Summary

A flaw in Apache Impala allows a Kerberos-authenticated user, lacking the necessary permissions, to manipulate running queries by injecting arbitrary data. This unauthorized data injection can lead to incorrect query results, potentially impacting data integrity and overall system reliability.

Affected Version(s)

Apache Impala Apache Impala 3.0.0

References

http://www.securityfocus.com/bid/105742
vdb-entryx_refsource_BID
https://lists.apache.org/thread.html/cba8f18df15af862aa07...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.