CVE-2025-62728
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-12-04
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | hive | 4.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL injection issue in the Hive Metastore Server (HMS) that occurs when processing delete column statistics requests via the Thrift APIs. It allows trusted or authorized users or applications that can directly call the Thrift APIs to potentially execute malicious SQL commands. However, in most deployments, HMS is only accessible to a limited set of applications, reducing the risk of exploitation. Additionally, the vulnerability can be mitigated by setting the metastore.try.direct.sql property to false, which disables the vulnerable code path.
How can this vulnerability impact me? :
If exploited by a trusted or authorized user or application with access to the Thrift APIs, this SQL injection vulnerability could allow unauthorized manipulation or deletion of data within the Hive Metastore. This could lead to data integrity issues or unauthorized data modification. However, the risk is limited because only trusted users with direct API access can exploit it, and the vulnerability is not reachable if the metastore.try.direct.sql property is set to false.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Apache Hive to version 4.2.0 or later. If upgrading is not immediately possible and the Hive Metastore Server Thrift APIs are exposed to general public or untrusted users, set the metastore.try.direct.sql property to false to prevent exploitation.