Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354 | Mailing List Vendor Advisory |
Configurations
History
21 Jul 2022, 13:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Apache
Apache hive |
|
| References | (CONFIRM) https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354 - Mailing List, Vendor Advisory | |
| CWE | CWE-306 |
16 Jul 2022, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-16 07:15
Updated : 2023-12-10 14:35
NVD link : CVE-2021-34538
Mitre link : CVE-2021-34538
CVE.ORG link : CVE-2021-34538
JSON object : View
Products Affected
apache
- hive
CWE
CWE-306
Missing Authentication for Critical Function