8.8high
CVE-2018-8028
Apache Sentry may allow attacker to access/remove data from Sentry protected table
Also known as GHSA-6xhj-p29v-82j8
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
0
none known
Summary
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table.
Exploit prediction (EPSS)
1.31% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.sentry:sentry | <2.0.1 | 2.0.1 |
Affected products
- Apache Software Foundation Apache Sentry
Classification
- Weakness
- CWE-862 Missing Authorization
References
- cwiki.apache.org /confluence/display/SENTRY/Vulnerabilities+found+in+Apache+Sentry · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-8028 · advisory
- github.com /apache/sentry · package
Sources
- CVE List: CVE-2018-8028
- GitHub Advisory: GHSA-6xhj-p29v-82j8
- NVD: CVE-2018-8028
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.