CVE-2018-1314

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Hive	All versions of Hive including 2.3.3, 3.1.0 and earlier

References

http://www.securityfocus.com/bid/105884Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E
http://www.securityfocus.com/bid/105884Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E

Timeline

Published: Nov 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-131408.1Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to do CVE-2018-131447.5The transfer and transferFrom functions of a smart contract implementation for Pandora (PDX), an Ethereum token, have an integer overflow. N CVE-2018-131457.5The mintToken function of a smart contract implementation for JavaSwapTest (JST), an Ethereum token, has an integer overflow.CVE-2018-131467.5The mintToken, buy, and sell functions of a smart contract implementation for LEF, an Ethereum token, have an integer overflow.CVE-2018-13153.7In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can CVE-2018-131536.5In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.CVE-2018-131557.5The mintToken function of a smart contract implementation for GEMCHAIN (GEM), an Ethereum token, has an integer overflow that allows the own CVE-2018-131567.5The mintToken function of a smart contract implementation for bonusToken (BNS), an Ethereum token, has an integer overflow that allows the o CVE-2018-131577.5The mintToken function of a smart contract implementation for CryptonitexCoin, an Ethereum token, has an integer overflow that allows the ow CVE-2018-131587.5The mintToken function of a smart contract implementation for AssetToken, an Ethereum token, has an integer overflow that allows the owner o CVE-2018-131597.5The mintToken function of a smart contract implementation for bankcoin (BNK), an Ethereum token, has an integer overflow that allows the own CVE-2018-13167.5The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directo