{"answers":{"affected":"4 open source packages ship an affected version, including org.apache.hive:hive-common and org.apache.hive:hive-metastore. It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-62728 in the wild and no public exploit code.","fix":"Upgrade org.apache.hive:hive-common to 4.2.0 or later.","what":"CVE-2025-62728 is a medium-severity SQL injection vulnerability in Apache Hive, published on 26 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-62728 and fix it if it is affected.\n\nWhat it is: CVE-2025-62728 is a medium-severity SQL injection vulnerability in Apache Hive, published on 26 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-62728 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.hive:hive-common (Maven): affected from 4.1.0; fixed in 4.2.0\n- org.apache.hive:hive-common (Maven): affected from 4.1.0; fixed in 4.2.0\n- org.apache.hive:hive-metastore (Maven): affected from 4.1.0; fixed in 4.2.0\n- org.apache.hive:hive-metastore (Maven): affected from 4.1.0; fixed in 4.2.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-62728/ (Markdown: https://insights.sbomify.com/CVE-2025-62728/index.md)","id":"CVE-2025-62728","markdown":"https://insights.sbomify.com/CVE-2025-62728/index.md","name":"CVE-2025-62728","record":{"aliases":["CLEANSTART-2026-ST63902","GHSA-932v-x9x2-vq29"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Hive","requires_auth":"low_privilege","summary":"Authorized users can execute arbitrary SQL via Hive Metastore Thrift APIs, requiring direct API access or specific configuration.","user_interaction":"not_required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"hive","vendor":"apache"}],"cvss":{"score":5.4,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"description":"SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only exploitable by trusted/authorized users/applications that are allowed to call directly the Thrift APIs. In most real-world deployments, HMS is accessible to only a handful of applications (e.g., Hiveserver2) thus the vulnerability is not exploitable. Moreover, the vulnerable code cannot be reached when metastore.try.direct.sql property is set to false.\n\nThis issue affects Apache Hive: from 4.1.0 before 4.2.0.\n\nUsers are recommended to upgrade to version 4.2.0, which fixes the issue. Users who cannot upgrade directly are encouraged to set metastore.try.direct.sql property to false if the HMS Thrift APIs are exposed to general public.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs","id":"CVE-2025-62728","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"sql_injection","year":"2025"},"n_packages":4,"n_references":1,"next":{"headline":"Stored XSS in SOPlanning","id":"CVE-2025-62729"},"packages":[{"ecosystem":"Maven","fixed":["4.2.0"],"introduced":["4.1.0"],"last_affected":[],"package":"org.apache.hive:hive-common","purl":null,"source":"GHSA-932v-x9x2-vq29"},{"ecosystem":"Maven","fixed":["4.2.0"],"introduced":["4.1.0"],"last_affected":[],"package":"org.apache.hive:hive-common","purl":"pkg:maven/org.apache.hive/hive-common","source":"GHSA-932v-x9x2-vq29"},{"ecosystem":"Maven","fixed":["4.2.0"],"introduced":["4.1.0"],"last_affected":[],"package":"org.apache.hive:hive-metastore","purl":null,"source":"GHSA-932v-x9x2-vq29"},{"ecosystem":"Maven","fixed":["4.2.0"],"introduced":["4.1.0"],"last_affected":[],"package":"org.apache.hive:hive-metastore","purl":"pkg:maven/org.apache.hive/hive-metastore","source":"GHSA-932v-x9x2-vq29"}],"prev":{"headline":"Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse","id":"CVE-2025-62727"},"products":["Apache Hive"],"published":"2025-11-26","related":[{"cvss_score":9.8,"headline":"Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths","id":"CVE-2026-49845","kev_date_added":null,"published":"2026-08-25"},{"cvss_score":9.8,"headline":"Deserialization of Untrusted Data in Jodd","id":"CVE-2018-21234","kev_date_added":null,"published":"2020-05-21"},{"cvss_score":9.1,"headline":"Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url","id":"CVE-2026-55976","kev_date_added":null,"published":"2026-08-25"},{"cvss_score":9.1,"headline":"SQL Injection in hive-jdbc","id":"CVE-2018-1282","kev_date_added":null,"published":"2018-04-05"},{"cvss_score":8.3,"headline":"Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore","id":"CVE-2022-41137","kev_date_added":null,"published":"2024-12-05"},{"cvss_score":8.3,"headline":"High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service","id":"CVE-2015-7521","kev_date_added":null,"published":"2016-01-29"},{"cvss_score":8.1,"headline":"Improper Authentication in hive:hive-exec","id":"CVE-2018-11777","kev_date_added":null,"published":"2018-11-08"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-12-01","vendors":["Apache Software Foundation"]},"summary":"Authorized users can execute arbitrary SQL via Hive Metastore Thrift APIs, requiring direct API access or specific configuration.","url":"https://insights.sbomify.com/CVE-2025-62728/"}