{"cve":"CVE-2021-34538","nvd":{"published":"2022-07-16T07:15:08.530","modified":"2026-06-17T03:56:05.427","status":"Modified","description":"Apache Hive before 3.1.3 \"CREATE\" and \"DROP\" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-306"],"references":["https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354","https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354"],"products":["apache:hive"],"source":"nvd","synced_at":"2026-10-19T21:33:44.859608815+00:00"},"epss":{"cve":"CVE-2021-34538","score":0.01859,"percentile":0.79223,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v3p8-j597-3xg8","url":"https://osv.dev/vulnerability/GHSA-v3p8-j597-3xg8","summary":"Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.","modified":"2026-09-10T03:49:44.901034741Z","packages":[{"ecosystem":"Maven","name":"org.apache.hive:hive","purl":"pkg:maven/org.apache.hive/hive","ranges":["<3.1.3"],"fixed":["3.1.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}