Authorization Flaw in Apache Hive Exposes Metadata to Unauthorized Users

CVE-2018-1314

Summary

In Apache Hive versions 2.3.3, 3.1.0, and earlier, there is a significant security oversight in the EXPLAIN operation that fails to validate the necessary authorization for entities involved in a query. This allows unauthorized users to perform the EXPLAIN operation on any arbitrary table or view, potentially exposing sensitive table metadata and statistical information. The lack of access control could lead to unauthorized data visibility, posing a risk to the security and confidentiality of user data.

References