GHSA-6xhj-p29v-82j8

    Dashboard / Vulnerabilities / GHSA-6xhj-p29v-82j8

    GHSA-6xhj-p29v-82j8

    Published: 13 May 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2018-8028

    Summary: Apache Sentry may allow attacker to access/remove data from Sentry protected table

    Details: An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table.

    References: https://nvd.nist.gov/vuln/detail/CVE-2018-8028, https://cwiki.apache.org/confluence/display/SENTRY/Vulnerabilities+found+in+Apache+Sentry, https://github.com/apache/sentry

    Affected packages

    Package

    Name: org.apache.sentry:sentry

    Purl: pkg:maven/org.apache.sentry/sentry

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.0.1

    Affected versions

    1.7.0
    1.7.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High