CVE-2018-1315
In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server…
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not verify the destination location of the downloaded file. This does not affect hive cli user and hiveserver2 user as hplsql is a separate command line script and needs to be invoked differently.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Low3.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 1.7% · top 22% of all CVEs (4 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.
Weakness
- Resource Injection
- CWE-732 (opens in a new tab)All about CWE-732 and its CVEs
Affected products
Apache Software Foundation · Apache Hive
- affected 2.1.0 to 2.3.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.hive:hiveGHSA-p639-xxv5-j383 (opens in a new tab)
- Mavenorg.apache.hive:hive-execGHSA-p639-xxv5-j383 (opens in a new tab)
- Mavenorg.apache.hive:hive-serviceGHSA-p639-xxv5-j383 (opens in a new tab)
References (1)
- [dev] 20180404 [SECURITY] CVE-2018-1315 'COPY FROM FTP' statement in HPL/SQL can write to arbitrary location if the FTP server is compromised (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-p639-xxv5-j383 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-1315)Record last updated .