How severe is CVE-2024-29869?

CVE-2024-29869 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2024-29869 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-29869?

CVE-2024-29869 affects Apache Hive. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-29869?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-29869 have an EU (EUVD) identifier?

Yes. CVE-2024-29869 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-0152.

When was CVE-2024-29869 published?

CVE-2024-29869 was published on 2025-01-28 and last updated on 2026-06-17.

CVE-2024-29869

CVE-2024-29869 is a medium-severity vulnerability in Apache Hive with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-732.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-0152
Weakness: CWE-732
Affected product: Apache Hive
Published: 2025-01-28
Last modified: 2026-06-17

Description

Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.

Frequently asked questions

What is CVE-2024-29869?: Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
How severe is CVE-2024-29869?: CVE-2024-29869 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2024-29869 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-29869?: CVE-2024-29869 affects Apache Hive. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-29869?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-29869 have an EU (EUVD) identifier?: Yes. CVE-2024-29869 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-0152.
When was CVE-2024-29869 published?: CVE-2024-29869 was published on 2025-01-28 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Hive

CVE-2018-21234 — Critical (CVSS 9.8): Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVE-2018-1282 — Critical (CVSS 9.1): This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass…
CVE-2022-41137 — High (CVSS 8.3): Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering…
CVE-2015-7521 — High (CVSS 8.3): The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger…
CVE-2018-11777 — High (CVSS 8.1): In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against…
CVE-2021-34538 — High (CVSS 7.5): Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved…

All CVEs affecting Apache Hive →

Other CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities

CVE-2026-9508 — Critical (CVSS 10.0): Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow…
CVE-2025-14988 — Critical (CVSS 10.0): A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain…
CVE-2025-69426 — Critical (CVSS 10.0): The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating…
CVE-2025-12004 — Critical (CVSS 10.0): Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown…
CVE-2014-125121 — Critical (CVSS 10.0): Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation…
CVE-2025-46093 — Critical (CVSS 9.9): LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to…

Browse all CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities →