EUVD-2026-71100
GHSA-5fmx-jr9j-qpgh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible module requires low-privileged authentication (PR:L); SQL injection yields complete Hive Metastore confidentiality, integrity, and availability impact with no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module.
This issue affects Apache Griffin Hive Metastore Module: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
SQL injection in Apache Griffin's Hive Metastore Module exposes all versions of this retired data quality platform to authenticated network exploitation. Low-privileged users can inject arbitrary SQL into Hive Metastore queries, achieving full confidentiality, integrity, and availability compromise of the underlying metadata store. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid, low-privileged account on the Apache Griffin instance (confirmed by PR:L in the provided CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic, low-friction authenticated SQL injection that yields complete database compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch exists and none will be produced - the Apache Software Foundation has officially retired Apache Griffin. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of systems running Apache Griffin, documenting network location, data sensitivity, and criticality; segment high-risk instances from untrusted network access where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today