Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nybp-ypbf-myb3
Vulnerability ID VCID-nybp-ypbf-myb3
Aliases CVE-2024-29869
GHSA-c476-j253-5rgq
Summary Apache Hive Incorrectly Assigns Permissions for a Critical Resource Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-29869
cvssv3.1 5.5 https://github.com/apache/hive
generic_textual MODERATE https://github.com/apache/hive
ssvc Track https://github.com/apache/hive
cvssv3.1 5.5 https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620
generic_textual MODERATE https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620
ssvc Track https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620
cvssv3.1 5.5 https://issues.apache.org/jira/browse/HIVE-28134
generic_textual MODERATE https://issues.apache.org/jira/browse/HIVE-28134
ssvc Track https://issues.apache.org/jira/browse/HIVE-28134
cvssv3.1 5.5 https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6
generic_textual MODERATE https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6
ssvc Track https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2024-29869
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-29869
cvssv3.1 5.5 http://www.openwall.com/lists/oss-security/2025/01/28/4
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2025/01/28/4
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-29869
https://github.com/apache/hive
https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620
https://issues.apache.org/jira/browse/HIVE-28134
https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6
http://www.openwall.com/lists/oss-security/2025/01/28/4
CVE-2024-29869 https://nvd.nist.gov/vuln/detail/CVE-2024-29869
GHSA-c476-j253-5rgq https://github.com/advisories/GHSA-c476-j253-5rgq
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/hive
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:24:47Z/ Found at https://github.com/apache/hive
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:24:47Z/ Found at https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://issues.apache.org/jira/browse/HIVE-28134
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:24:47Z/ Found at https://issues.apache.org/jira/browse/HIVE-28134
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:24:47Z/ Found at https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-29869
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2025/01/28/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.26606
EPSS Score 0.00096
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:23:10.283595+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hive/hive-exec/CVE-2024-29869.yml 38.6.0