Information disclosure in Apache Hive
CVE-2018-1284
In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveSer…
Vulnerability class: Information Disclosure
EPSS: 0.023 (80.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Apache Hive
- Apache Software Foundation Hive — versions 0.6.0 to 2.3.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-1284?
- CVE-2018-1284 is a low-severity vulnerability in Apache Hive, classified under Information Disclosure. CVSS score: 3.7/10. Published 2018-04-05.
- How severe is CVE-2018-1284?
- Low severity. CVSS v3 base score is 3.7 out of 10.
- Is CVE-2018-1284 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.