Privilege Escalation Vulnerability in Apache Impala by Cloudera

CVE-2018-11792

Summary

In versions of Apache Impala prior to 3.0.1, a privilege escalation vulnerability exists that allows a user to exploit insufficient checks in the ALTER TABLE/VIEW RENAME command. This weakness may enable users with ALTER privileges on an existing table, combined with ALL privileges on a database, to move that table to a different database. Consequently, the user's ALL rights will propagate to the table unintentionally, granting unauthorized access and modification capabilities within the database.

References