PUBLISHED
2026-09-09 11:17
MODIFIED
2026-09-09 11:17
EPSS (Prob. Exploit)
0.54%
Top 55.1%
> DESCRIPTION
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-918: Server-Side Request Forgery (SSRF) - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Impala: Avro Schema URL Server-Side Request Forgery
> HISTORIQUE DES MODIFICATIONS
Première apparition
09/09/2026 11:17
Source: NVD
📊
ENRICHISSEMENT
01/10/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-918: Server-Side Request Forgery (SSRF) - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure th...
Total des modifications: 1
Dernière mise à jour: 3 weeks ago