CVE-2024-29869CWE-732

Apache Hive: Credentials file created with non restrictive permissions

Medium · published January 28, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-01-28T21:31Z
EPSS history
Timeline
  • 28 JAN 21:31Z
    Apache Hive: Credentials file created with non restrictive permissions
    cvelistv5