5.9

CVE-2024-23945: apache software foundation apache hive

CVSS: 5.9v3.1MediumAnalyzed
AliasesCGA-gj3q-2r26-rq3wCGA-gwxh-ww4h-jx48GHSA-77pm-w3hx-f8mj
Published 23-12-2024Last modified 19-03-2025
Open JSON

Vulnerability summary

CVE-2024-23945 is a medium (CVSS 5.9) vulnerability in apache software foundation apache hive. EPSS estimates a 1.56% chance of exploitation in the next 30 days, higher than 74.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.56%
0%100%
Low · +0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 23-12-2024
    PublishedVulnerability first disclosed.
  2. 19-03-2025
    Last modifiedVulnerability information updated.

Description

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

1.56%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

+0.05 pp

From 1.51% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.56%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (issues.apache.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Apache2 products
  • hive≥ 1.2.0, < 4.0.0
  • spark≥ 2.0.0, < 3.3.4 | ≥ 3.4.0, < 3.4.2 | 3.5.0
Apache software foundation2 products
Org.apache.spark2 products
  • spark-hive-thriftserver_2.11≤ 2.4.8
  • spark-hive-thriftserver_2.12< 3.4.2
Chainguard1 product
  • rangerAll versions (No fix recorded)
Org.apache.hive1 product
  • hive-service≥ 1.2.0, < 4.0.0

5 vendors · 8 products

References

12 links
Show all 12 references