{"url":"http://public2.vulnerablecode.io/api/packages/54619?format=json","purl":"pkg:maven/org.apache.hive/hive@2.1.1","type":"maven","namespace":"org.apache.hive","name":"hive","version":"2.1.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"3.1.3","latest_non_vulnerable_version":"3.1.3","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/40420?format=json","vulnerability_id":"VCID-c6s8-kd2p-b3cn","summary":"Improper Access Control\nIn Apache Hive, local resources on HiveServer2 machines are not properly protected against a malicious user if ranger, sentry or sql standard authorizer is not in use.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-11777","reference_id":"","reference_type":"","scores":[{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48447","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48411","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48399","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48428","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48378","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00249","scoring_system":"epss","scoring_elements":"0.48441","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-11777"},{"reference_url":"https://github.com/apache/hive/commit/00c0ee7bc4b8492476b377a6edafcc33411f14b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/hive/commit/00c0ee7bc4b8492476b377a6edafcc33411f14b"},{"reference_url":"https://github.com/apache/hive/commit/1a1d6ca1bc3ae840238dc345fa1eb2c7c28c8cb","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/hive/commit/1a1d6ca1bc3ae840238dc345fa1eb2c7c28c8cb"},{"reference_url":"https://github.com/apache/hive/commit/f0419dfaabe31dd7802c37aeebab101265907e1","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/hive/commit/f0419dfaabe31dd7802c37aeebab101265907e1"},{"reference_url":"https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb@%3Cdev.hive.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb@%3Cdev.hive.apache.org%3E"},{"reference_url":"http://www.securityfocus.com/bid/105886","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/105886"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11777","reference_id":"CVE-2018-11777","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11777"},{"reference_url":"https://github.com/advisories/GHSA-rrfq-g5fq-fc9c","reference_id":"GHSA-rrfq-g5fq-fc9c","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rrfq-g5fq-fc9c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/56971?format=json","purl":"pkg:maven/org.apache.hive/hive@2.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-gcgn-udwx-xqft"},{"vulnerability":"VCID-he9j-yvcw-cuet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.3.4"},{"url":"http://public2.vulnerablecode.io/api/packages/56972?format=json","purl":"pkg:maven/org.apache.hive/hive@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-gcgn-udwx-xqft"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@3.1.1"}],"aliases":["CVE-2018-11777","GHSA-rrfq-g5fq-fc9c"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-c6s8-kd2p-b3cn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39541?format=json","vulnerability_id":"VCID-cccj-uhyy-hbew","summary":"Information Exposure\nIn Apache Hiveto, malicious user might use any xpath UDFs to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if `hive.serverenable.doAs=false`.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1284.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1284.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1284","reference_id":"","reference_type":"","scores":[{"value":"0.00469","scoring_system":"epss","scoring_elements":"0.64925","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00469","scoring_system":"epss","scoring_elements":"0.6493","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00469","scoring_system":"epss","scoring_elements":"0.64908","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00469","scoring_system":"epss","scoring_elements":"0.64919","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00469","scoring_system":"epss","scoring_elements":"0.64878","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00469","scoring_system":"epss","scoring_elements":"0.6492","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1284"},{"reference_url":"https://github.com/apache/hive/commit/b0a58d245875dc1b3ac58a7cf1a61d3b17805e96","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/hive/commit/b0a58d245875dc1b3ac58a7cf1a61d3b17805e96"},{"reference_url":"https://github.com/apache/hive/commit/f80a38ae1174553022deae4f8774918401d9756d","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/hive/commit/f80a38ae1174553022deae4f8774918401d9756d"},{"reference_url":"https://issues.apache.org/jira/browse/HIVE-18879","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/HIVE-18879"},{"reference_url":"https://lists.apache.org/thread.html/29184dbce4a37be2af36e539ecb479b1d27868f73ccfdff46c7174b4@%3Cdev.hive.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/29184dbce4a37be2af36e539ecb479b1d27868f73ccfdff46c7174b4@%3Cdev.hive.apache.org%3E"},{"reference_url":"http://www.securityfocus.com/bid/103750","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/103750"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564357","reference_id":"1564357","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564357"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1284","reference_id":"CVE-2018-1284","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1284"},{"reference_url":"https://github.com/advisories/GHSA-rxmr-c9jm-7mm8","reference_id":"GHSA-rxmr-c9jm-7mm8","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rxmr-c9jm-7mm8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/55325?format=json","purl":"pkg:maven/org.apache.hive/hive@2.3.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-c6s8-kd2p-b3cn"},{"vulnerability":"VCID-gcgn-udwx-xqft"},{"vulnerability":"VCID-he9j-yvcw-cuet"},{"vulnerability":"VCID-kp77-nwjw-rfgy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.3.3"}],"aliases":["CVE-2018-1284","GHSA-rxmr-c9jm-7mm8"],"risk_score":3.0,"exploitability":"0.5","weighted_severity":"5.9","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cccj-uhyy-hbew"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39539?format=json","vulnerability_id":"VCID-edzt-r4b9-muht","summary":"Incorrect Permission Assignment for Critical Resource\nIn Apache Hiveto, when `COPY FROM FTP` statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not verify the destination location of the downloaded file. This does not affect hive cli user and hiveserver2 user as hplsql is a separate command line script and needs to be invoked differently.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1315.json","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1315.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1315","reference_id":"","reference_type":"","scores":[{"value":"0.01026","scoring_system":"epss","scoring_elements":"0.77662","published_at":"2026-06-09T12:55:00Z"},{"value":"0.01026","scoring_system":"epss","scoring_elements":"0.77628","published_at":"2026-06-04T12:55:00Z"},{"value":"0.01026","scoring_system":"epss","scoring_elements":"0.77656","published_at":"2026-06-05T12:55:00Z"},{"value":"0.01026","scoring_system":"epss","scoring_elements":"0.77663","published_at":"2026-06-06T12:55:00Z"},{"value":"0.01026","scoring_system":"epss","scoring_elements":"0.77653","published_at":"2026-06-07T12:55:00Z"},{"value":"0.01026","scoring_system":"epss","scoring_elements":"0.77642","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1315"},{"reference_url":"https://lists.apache.org/thread.html/d5da94ef60312c01a8d2348466680d1b5fb70702c71a3e84e94f7933@%3Cdev.hive.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/d5da94ef60312c01a8d2348466680d1b5fb70702c71a3e84e94f7933@%3Cdev.hive.apache.org%3E"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564364","reference_id":"1564364","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564364"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1315","reference_id":"CVE-2018-1315","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1315"},{"reference_url":"https://github.com/advisories/GHSA-p639-xxv5-j383","reference_id":"GHSA-p639-xxv5-j383","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p639-xxv5-j383"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/55325?format=json","purl":"pkg:maven/org.apache.hive/hive@2.3.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-c6s8-kd2p-b3cn"},{"vulnerability":"VCID-gcgn-udwx-xqft"},{"vulnerability":"VCID-he9j-yvcw-cuet"},{"vulnerability":"VCID-kp77-nwjw-rfgy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.3.3"}],"aliases":["CVE-2018-1315","GHSA-p639-xxv5-j383"],"risk_score":2.9,"exploitability":"0.5","weighted_severity":"5.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-edzt-r4b9-muht"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/110405?format=json","vulnerability_id":"VCID-gcgn-udwx-xqft","summary":"Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.\nApache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34538","reference_id":"","reference_type":"","scores":[{"value":"0.00451","scoring_system":"epss","scoring_elements":"0.64076","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00451","scoring_system":"epss","scoring_elements":"0.64028","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00451","scoring_system":"epss","scoring_elements":"0.6407","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00451","scoring_system":"epss","scoring_elements":"0.64079","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00451","scoring_system":"epss","scoring_elements":"0.64068","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00451","scoring_system":"epss","scoring_elements":"0.64056","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34538"},{"reference_url":"https://github.com/apache/hive","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/hive"},{"reference_url":"https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34538","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34538"},{"reference_url":"https://github.com/advisories/GHSA-v3p8-j597-3xg8","reference_id":"GHSA-v3p8-j597-3xg8","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v3p8-j597-3xg8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/149043?format=json","purl":"pkg:maven/org.apache.hive/hive@3.1.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@3.1.3"}],"aliases":["CVE-2021-34538","GHSA-v3p8-j597-3xg8"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gcgn-udwx-xqft"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54195?format=json","vulnerability_id":"VCID-he9j-yvcw-cuet","summary":"Information Exposure\nApache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1926","reference_id":"","reference_type":"","scores":[{"value":"0.00478","scoring_system":"epss","scoring_elements":"0.65394","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00478","scoring_system":"epss","scoring_elements":"0.65352","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00478","scoring_system":"epss","scoring_elements":"0.65404","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00478","scoring_system":"epss","scoring_elements":"0.65414","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00478","scoring_system":"epss","scoring_elements":"0.65403","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1926"},{"reference_url":"https://issues.apache.org/jira/browse/HIVE-22708","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/HIVE-22708"},{"reference_url":"https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1926","reference_id":"CVE-2020-1926","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1926"},{"reference_url":"https://github.com/advisories/GHSA-54g4-5cf6-hjp3","reference_id":"GHSA-54g4-5cf6-hjp3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-54g4-5cf6-hjp3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79992?format=json","purl":"pkg:maven/org.apache.hive/hive@2.3.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-gcgn-udwx-xqft"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.3.8"}],"aliases":["CVE-2020-1926","GHSA-54g4-5cf6-hjp3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-he9j-yvcw-cuet"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/40419?format=json","vulnerability_id":"VCID-kp77-nwjw-rfgy","summary":"Missing Authorization\nThe Hive `EXPLAIN` operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do `EXPLAIN` on arbitrary table or view and expose table metadata and statistics.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1314","reference_id":"","reference_type":"","scores":[{"value":"0.00374","scoring_system":"epss","scoring_elements":"0.59446","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00374","scoring_system":"epss","scoring_elements":"0.59436","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00374","scoring_system":"epss","scoring_elements":"0.59418","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00374","scoring_system":"epss","scoring_elements":"0.59437","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00374","scoring_system":"epss","scoring_elements":"0.59392","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00374","scoring_system":"epss","scoring_elements":"0.59443","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1314"},{"reference_url":"https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727@%3Cdev.hive.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727@%3Cdev.hive.apache.org%3E"},{"reference_url":"http://www.securityfocus.com/bid/105884","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/105884"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1314","reference_id":"CVE-2018-1314","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1314"},{"reference_url":"https://github.com/advisories/GHSA-jmf4-pq78-f8vj","reference_id":"GHSA-jmf4-pq78-f8vj","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jmf4-pq78-f8vj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/56971?format=json","purl":"pkg:maven/org.apache.hive/hive@2.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-gcgn-udwx-xqft"},{"vulnerability":"VCID-he9j-yvcw-cuet"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.3.4"},{"url":"http://public2.vulnerablecode.io/api/packages/56972?format=json","purl":"pkg:maven/org.apache.hive/hive@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-gcgn-udwx-xqft"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@3.1.1"}],"aliases":["CVE-2018-1314","GHSA-jmf4-pq78-f8vj"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kp77-nwjw-rfgy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39119?format=json","vulnerability_id":"VCID-z8jz-kv82-c3gk","summary":"Information Exposure\nApache Hive expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.","references":[{"reference_url":"http://mail-archives.apache.org/mod_mbox/hive-user/201710.mbox/%3C3791103E-80D5-4E75-AF23-6F8ED54DDEBE%40apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://mail-archives.apache.org/mod_mbox/hive-user/201710.mbox/%3C3791103E-80D5-4E75-AF23-6F8ED54DDEBE%40apache.org%3E"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12625","reference_id":"","reference_type":"","scores":[{"value":"0.00468","scoring_system":"epss","scoring_elements":"0.64862","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00468","scoring_system":"epss","scoring_elements":"0.64867","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00468","scoring_system":"epss","scoring_elements":"0.64861","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00468","scoring_system":"epss","scoring_elements":"0.6482","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00468","scoring_system":"epss","scoring_elements":"0.64872","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00468","scoring_system":"epss","scoring_elements":"0.6485","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12625"},{"reference_url":"http://www.securityfocus.com/bid/101686","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/101686"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12625","reference_id":"CVE-2017-12625","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12625"},{"reference_url":"https://github.com/advisories/GHSA-2g9q-chq2-w8qw","reference_id":"GHSA-2g9q-chq2-w8qw","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2g9q-chq2-w8qw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/144267?format=json","purl":"pkg:maven/org.apache.hive/hive@2.1.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.1.2"},{"url":"http://public2.vulnerablecode.io/api/packages/144268?format=json","purl":"pkg:maven/org.apache.hive/hive@2.2.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.2.1"},{"url":"http://public2.vulnerablecode.io/api/packages/54622?format=json","purl":"pkg:maven/org.apache.hive/hive@2.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-c6s8-kd2p-b3cn"},{"vulnerability":"VCID-cccj-uhyy-hbew"},{"vulnerability":"VCID-edzt-r4b9-muht"},{"vulnerability":"VCID-gcgn-udwx-xqft"},{"vulnerability":"VCID-he9j-yvcw-cuet"},{"vulnerability":"VCID-kp77-nwjw-rfgy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.3.1"}],"aliases":["CVE-2017-12625","GHSA-2g9q-chq2-w8qw"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z8jz-kv82-c3gk"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hive/hive@2.1.1"}