CVE-2018-11777

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Hive	All versions of Hive, including 2.3.3, 3.1.0 and earlier

References

http://www.securityfocus.com/bid/105886Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb%40%3Cdev.hive.apache.org%3E
http://www.securityfocus.com/bid/105886Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb%40%3Cdev.hive.apache.org%3E

Timeline

Published: Nov 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-117788.8UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions p CVE-2018-117799.8In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the S CVE-2018-11788.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interacti CVE-2018-117809.8A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.CVE-2018-117817.8Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.CVE-2018-117826.5In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed r CVE-2018-117837.5sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin.CVE-2018-117844.3When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directo CVE-2018-117856.5Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a CVE-2018-117868.8In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any use CVE-2018-117878.1In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/conso CVE-2018-117889.8Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy fol