CVE-2014-0228

Published: Nov 16, 2014Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.

Affected (1)

Products: Apache: Hive

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Hive	Up to 0.13.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (6)

http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g%40mail.gmail.com%3E

Source: secalert@redhat.com

http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/532418/100/0/threaded

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/127091/Apache-Hive-0.13.0-Authorization-Failure.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/532418/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.