CVE-2018-1282
CRITICALApache Hive < 2.3.2 - SQL Injection
Title source: ruleDescription
This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
References (3)
Scores
CVSS v3
9.1
EPSS
0.0055
EPSS Percentile
67.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Classification
CWE
CWE-89
Status
published
Affected Products (2)
apache/hive
< 2.3.2
org.apache.hive/hive-jdbc
< 2.3.3Maven
Timeline
Published
Apr 05, 2018
Tracked Since
Feb 18, 2026