Read the docs
TI-2005-04579 Aliases CVE-2005-4849GHSA-rp7r-79rm-2758

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in…

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.

Why it matters now

EPSS 0.02451 84th percentileScored 2026-11-07
Fix Fixed org.apache.derby:derby (Maven): 10.1.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.derby:derby (Maven)before 10.1.2.110.1.2.1Patch availableGHSA-rp7r-79rm-2758
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.derby:derby (Maven) Vendor— Affected before 10.1.2.1 Fixed in 10.1.2.1 Patch available GHSA-rp7r-79rm-2758

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:*up to 10.1.1.0VulnerableApache
  • cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:* Versions up to 10.1.1.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-rp7r-79rm-2758 org.apache.derby:derby (Maven) Fixed in 10.1.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-4849
  2. 2026-10-03 Alias added: GHSA-rp7r-79rm-2758

References

Patch 1

Advisory 1

Other 7

  • TI-2015-01645 XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before… CVSS 3.0CRITICAL 9.1
  • TI-2022-22882 Apache Derby: LDAP injection vulnerability in authenticator CVSS 3.1CRITICAL 9.8
  • TI-2010-02141 Improper access control in Apache Derby CVSS 3.0HIGH 7.5
  • TI-2018-01216 Improper access control in Apache Derby CVSS 3.1MEDIUM 5.3
  • TI-2006-06958 Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the… CVSS 2.0MEDIUM 4.0
  • TI-2006-06957 Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table… CVSS 2.0MEDIUM 4.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences