CVE-2015-7521 High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

What is CVE-2015-7521?

CVE-2015-7521 is a high-severity authentication bypass vulnerability in n/a, published on 29 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.

Weakness: CWE-287

Which versions are affected by CVE-2015-7521?

6 open source packages ship an affected version, including org.apache.hive:hive, org.apache.hive:hive-exec and org.apache.hive:hive-service. It affects 1 product.

Products include Apache Hive.

How do I fix CVE-2015-7521?

Upgrade org.apache.hive:hive to 1.2.2 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2015-7521 being exploited?

There is no known exploitation of CVE-2015-7521 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths Critical 9.8
• CVE-2018-21234 Deserialization of Untrusted Data in Jodd Critical 9.8
• CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url Critical 9.1
• CVE-2018-1282 SQL Injection in hive-jdbc Critical 9.1
• CVE-2022-41137 Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-83r3-c79w-f6wc.