CVE-2021-34538
Last modified
CVE-2021-34538 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. EPSS estimates a 1.39% chance of exploitation in the next 30 days.
Description
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Hive | < 3.1.3 |
References
- https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354Mailing List, Vendor Advisory
- https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354Mailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-34538?
How severe is CVE-2021-34538?
How do I fix CVE-2021-34538?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-34532ASP.NET Core and Visual Studio Information Disclosure Vulner…5.5
- CVE-2021-34533Windows Graphics Component Font Parsing Remote Code Executio…7.8
- CVE-2021-34534Windows MSHTML Platform Remote Code Execution Vulnerability6.8
- CVE-2021-34535Remote Desktop Client Remote Code Execution Vulnerability8.8
- CVE-2021-34536Windows Storage Spaces Controller Elevation of Privilege Vul…7.8
- CVE-2021-34537Windows Bluetooth Driver Elevation of Privilege Vulnerabilit…7.8
- CVE-2021-34539An issue was discovered in CubeCoders AMP before 2.1.1.8. A …7.2
- CVE-2021-3454Truncated L2CAP K-frame causes assertion failure. Zephyr ver…7.5
- CVE-2021-34540Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the usern…6.1
- CVE-2021-34543The web administration server in Solar-Log 500 before 2.8.2 …7.5
- CVE-2021-34544An issue was discovered in Solar-Log 500 before 2.8.2 Build …6.5
- CVE-2021-34546An unauthenticated attacker with physical access to a comput…6.8
Are you affected by CVE-2021-34538?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST