CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2016-3083
https://notcve.org/view.php?id=CVE-2016-3083
30 May 2017 — Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept th... • http://www.securityfocus.com/bid/98669 • CWE-295: Improper Certificate Validation •
CVSS: 8.3EPSS: 0%CPEs: 5EXPL: 0CVE-2015-7521 – Apache Hive Authorization Bypass
https://notcve.org/view.php?id=CVE-2015-7521
29 Jan 2016 — The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations. El marco de autorización en Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 y 1.2.1 en clusters protegidos por Ranger y SqlStdHiveAuthorization, permite a atacantes eludir las restricciones de acceso de tabla padre previstas a través de operaciones a n... • http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E • CWE-287: Improper Authentication •
CVSS: 7.3EPSS: 0%CPEs: 5EXPL: 0CVE-2015-1772
https://notcve.org/view.php?id=CVE-2015-1772
21 Dec 2015 — The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request. La implementación de LDAP en Apache Hive en versiones anteriores a 1.0.1 y 1.1.x en versiones anteriores a 1.1.1, como se utiliza en IBM InfoSphere BigInsights 3.0, 3.0.0.1 y 3.0.0.2 y ... • http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q%40mail.gmail.com%3E • CWE-287: Improper Authentication •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0228 – Apache Hive 0.13.0 Authorization Failure
https://notcve.org/view.php?id=CVE-2014-0228
13 Jun 2014 — Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI. En Apache Hive anterior a 0.13.1., cuando se usa el modo de autorización basada en estandares SQL , no se comprueban correctamente los permisos de archivo para las declaraciones de (1) import y (2) export, permitiendo a usuarios autenticados obtener informaci... • http://mail-archives.apache.org/mod_mbox/hive-user/201406.mbox/%3CCABgNGzeN7E+9d=YV5yvnKA7wmSx1op_avtUjPcPtDaR6DLJM6g%40mail.gmail.com%3E • CWE-284: Improper Access Control •