In Apache Hive 2.3.3, 3.1.0 and earlier, Hive “EXPLAIN” operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do “EXPLAIN” on arbitrary table or view and expose table metadata and statistics.
[
{
"product": "Apache Hive",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "All versions of Hive including 2.3.3, 3.1.0 and earlier"
}
]
}
]