CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a…

Description

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.

Scores

EPSS (exploitation in 30 days)

1.7% · top 23% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

• User Authentication
• CWE-362 (opens in a new tab)All about CWE-362 and its CVEs

Affected products

• Apache Software Foundation · Apache HBase

  • affected Apache Tomcat 1.x and 2.x, excluding 1.0.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.hbase:hbase-thriftGHSA-r86j-2gc6-2cq9 (opens in a new tab)

References (2)

• 104554 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• https://lists.apache.org/thread.html/a919e38f587c714c386a01d40fc8f45bd4219a65aaf2dc0bb4eccc96%40%3Cdev.hbase.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-r86j-2gc6-2cq9 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-8025](https://trackcve.app/badge/CVE-2018-8025.svg)](https://trackcve.app/cve/CVE-2018-8025)

Record last updated 16 Sept 2024, 16:12 UTC.