N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62728

CVE-2025-62728: Hive Metastore Server is vulnerable to SQL Injection

SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only exploitable by trusted/authorized users/applications that are allowed to call directly the Thrift APIs. In most real-world deployments, HMS is accessible to only a handful of applications (e.g., Hiveserver2) thus the vulnerability is not exploitable. Moreover, the vulnerable code cannot be reached when metastore.try.direct.sql property is set to false.

This issue affects Apache Hive: from 4.1.0 before 4.2.0.

Users are recommended to upgrade to version 4.2.0, which fixes the issue. Users who cannot upgrade directly are encouraged to set metastore.try.direct.sql property to false if the HMS Thrift APIs are exposed to general public.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62728

CVE-2025-62728:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.hive:hive-common	maven	>= 4.1.0, < 4.2.0	4.2.0
org.apache.hive:hive-metastore	maven	>= 4.1.0, < 4.2.0	4.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit c18d0df2702130cf5d0f050e516eb8999aa56301 reveals multiple SQL injection vulnerabilities within the MetaStoreDirectSql.java file. The root cause is the unsafe construction of SQL queries using string concatenation with user-provided input, specifically when deleting table and partition column statistics, and when locking tables.

The primary vulnerability, as described in the CVE, relates to the deletion of column statistics. The patch addresses this in two places:

The deleteTableColumnStatistics method, which was concatenating column names and the engine name directly into the SQL string.
An anonymous inner class's run method, responsible for deleting partition column statistics, which had the same string concatenation flaw.

Both vulnerabilities are fixed by converting the code to use parameterized SQL queries, which properly separates the query logic from the data and prevents injection attacks.

Additionally, the patch fixes a similar SQL injection vulnerability in the lockDbTable method, which was also using string concatenation for the table name. The fix here involves an allowlist check on the table name.

The identified functions are all within the org.apache.hadoop.hive.metastore.MetaStoreDirectSql class, which is invoked when the metastore.try.direct.sql configuration property is enabled. These functions would appear in a runtime profile when a malicious request to the Hive Metastore Thrift API triggers the vulnerable code paths.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.