CVE-2021-40331

HIGH

Apache Ranger Hive Plugin <2.4.0 - Privilege Escalation

Title source: llm
STIX 2.1

Description

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.

References (1)

Core 1
Core References
Issue Tracking, Patch, Vendor Advisory vendor-advisory
https://lists.apache.org/thread/s68yls6cnkdmzn1k4hqt50vs6wjvt2rn

Scores

CVSS v3 8.1
EPSS 0.0014
EPSS Percentile 33.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-732
Status published
Products (2)
apache/ranger 2.0.0 - 2.3.0
org.apache.ranger/ranger-hive-plugin 2.0.0 - 2.4.0Maven
Published May 05, 2023
Tracked Since Feb 18, 2026