What’s Vulnerable › Vulnerabilities

CVE-2018-1314

• Severity: medium (CVSS 4.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-08 · updated 2026-06-17
• Weakness: CWE-862

Description

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.

Affected products

• Apache Software Foundation Apache Hive: through 2.3.3; from 3.0.0 through 3.1.0

References

• http://www.securityfocus.com/bid/105884
• https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E
• http://www.securityfocus.com/bid/105884
• https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E

Get alerted when CVE-2018-1314 or the next vulnerability affects your stack