Auth bypass in Apache Hive
CVE-2015-1772
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurati…
Vulnerability class: Broken Authentication
EPSS: 0.068 (93.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Apache Hive — versions 1.0.0, 1.1.0
- Ibm Infosphere_biginsights — versions 3.0.0.0, 3.0.0.1, 3.0.0.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2015-1772?
- CVE-2015-1772 is a high-severity vulnerability in Apache Hive, classified under Improper Authentication. CVSS score: 7.3/10. Published 2015-12-21.
- How severe is CVE-2015-1772?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2015-1772 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.