In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apache.hive:hive-exec(Maven) | 3.0.0 | 3.1.1 | N/A |
| org.apache.hive:hive-exec(Maven) | 0 | 2.3.4 | N/A |
CVSS Metrics
