CVE-2015-1889

IBM InfoSphere BigInsights 3.0-3.0.0.2 SQL Injection via Big SQL

Title source: llm
STIX 2.1

Description

The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via (1) a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or (2) an import of a certain Hive table definition with the HCAT_SYNC_OBJECTS procedure.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032150
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21700654

Scores

EPSS 0.0158
EPSS Percentile 72.9%

Details

CWE
CWE-89
Status published
Products (3)
ibm/infosphere_biginsights 3.0.0.0
ibm/infosphere_biginsights 3.0.0.1
ibm/infosphere_biginsights 3.0.0.2
Published Apr 22, 2015
Tracked Since Feb 18, 2026