Known vulnerabilities in Apache Hive

Known vulnerabilities in Apache Hive

Vendor: Apache Foundation

Software: Apache Hive

Software CPE: cpe:2.3:a:apache_foundation:apache_hive:*:*:*:*:*:*:*:*

Website: https://www.apache.org

Total vulnerabilities: 10

Public exploits: 1

Known exploited (KEV): 1

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (10)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU118822 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2025-62728	CWE-89	Low	No	No	4.2.0	28.11.2025	SB2025112808 SB2026040825
#VU112037 - Information Exposure Through Timing Discrepancy CVE-2024-23953	CWE-208	Medium	No	No	4.0.0	30.06.2025	SB2025063002 SB2025063009 SB2025090101 and 1 more
#VU111975 - Incorrect Permission Assignment for Critical Resource CVE-2024-29869	CWE-732	Low	No	No	4.0.1	26.06.2025	SB2025062649 SB2025063009 SB2025090102 and 1 more
#VU101900 - Exposure of sensitive information to an unauthorized actor CVE-2024-23945	CWE-200	Medium	No	No	4.0.0	23.12.2024	SB2024122315 SB2024122316 SB2025011044
#VU58816 - Improper Control of Generation of Code ('Code Injection') CVE-2021-44228	CWE-94	Critical	Available	Exploited	-	10.12.2021	SB2021121003 SB2021121101 SB2021121201 and 338 more
#VU51105 - Exposure of sensitive information to an unauthorized actor CVE-2020-1926	CWE-200	Medium	No	No	2.3.8	02.03.2021	SB2021030218
#VU15782 - Permissions, Privileges, and Access Controls CVE-2018-11777	CWE-264	Low	No	No	2.3.4, 3.1.1	09.11.2018	SB2018110910
#VU15781 - Permissions, Privileges, and Access Controls CVE-2018-1314	CWE-264	Low	No	No	2.3.4, 3.1.1	08.11.2018	SB2018110910
#VU11626 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2018-1284	CWE-611	Low	No	No	-	10.04.2018	SB2018041006
#VU11627 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2018-1282	CWE-89	Low	No	No	-	09.04.2018	SB2018041006 SB2023071977