CVE-2021-34538

Published: Jul 16, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.

Affected (1)

Products: Apache: Hive

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Hive	Before 3.1.3

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.