CVE-2024-29869
Last modified
CVE-2024-29869 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Hive | >= 1.1.0, < 4.0.1 |
References
- https://issues.apache.org/jira/browse/HIVE-28134Issue Tracking
- https://lists.apache.org/thread/h27ohpyrqf9w1m3c0tqr7x8jg59rcrv6Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/01/28/4Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-29869?
How severe is CVE-2024-29869?
How do I fix CVE-2024-29869?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-29862The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder…7.5
- CVE-2024-29863A race condition in the installer executable in Qlik Qlikvie…7.8
- CVE-2024-29864Distrobox before 1.7.0.1 allows attackers to execute arbitra…9.8
- CVE-2024-29865Logpoint before 7.1.0 allows Self-XSS on the LDAP authentica…5.4
- CVE-2024-29866Datalust Seq before 2023.4.11151 and 2024 before 2024.1.1114…9.1
- CVE-2024-29868Use of Cryptographically Weak Pseudo-Random Number Generator…9.1
- CVE-2024-2987A vulnerability classified as critical has been found in Ten…8.8
- CVE-2024-29870SQL injection vulnerability in Sentrifugo 3.2, through /sent…9.8
- CVE-2024-29871SQL injection vulnerability in Sentrifugo 3.2, through /sent…9.8
- CVE-2024-29872SQL injection vulnerability in Sentrifugo 3.2, through /sent…9.8
- CVE-2024-29873SQL injection vulnerability in Sentrifugo 3.2, through /sent…9.8
- CVE-2024-29874SQL injection vulnerability in Sentrifugo 3.2, through /sent…9.8
Are you affected by CVE-2024-29869?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST