CVE-2021-34538
Apache Hive Security vulnerability in Hive with UDFs
- State
- Published
- Severity
- Not scored
- Published
- Jul 16, 2022
- Updated
- Aug 4, 2024
- Reserved
- Jun 10, 2021
Description
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.
Scores
The record has no CVSS score.
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Apache HiveApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.