#VU15782 Security restrictions bypass in Apache Hive - CVE-2018-11777
Published: November 9, 2018
Vulnerability identifier: #VU15782
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-11777
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Apache Hive
Apache Hive
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote authenticated attacker to bypass security restrictions on the target system.
The vulnerability exists due to improper security restrictions on local resources on HiveServer2 servers. A remote authenticated attacker can bypass security restrictions, access or modify any file if the Ranger, Sentry or SQL Standard authorizers are not in use and conduct further attacks.
Remediation
The vulnerability has been fixed in the versions 2.3.4, 3.1.1.