Read the docs
TI-2006-06957 Aliases CVE-2006-7216GHSA-3ph6-4gjf-m5qj

Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table…

Priority LOW 23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.

Why it matters now

EPSS 0.02175 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:derby:10.1.1.0:*:*:*:*:*:*:*10.1.1.0VulnerableApache
cpe:2.3:a:apache:derby:10.1.2.1:*:*:*:*:*:*:*10.1.2.1VulnerableApache
cpe:2.3:a:apache:derby:10.1.3.1:*:*:*:*:*:*:*10.1.3.1VulnerableApache
  • cpe:2.3:a:apache:derby:10.1.1.0:*:*:*:*:*:*:* Versions 10.1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:derby:10.1.2.1:*:*:*:*:*:*:* Versions 10.1.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:derby:10.1.3.1:*:*:*:*:*:*:* Versions 10.1.3.1 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-7216
  2. 2026-10-03 Alias added: GHSA-3ph6-4gjf-m5qj

References

Patch 2

  • TI-2015-01645 XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before… CVSS 3.0CRITICAL 9.1
  • TI-2022-22882 Apache Derby: LDAP injection vulnerability in authenticator CVSS 3.1CRITICAL 9.8
  • TI-2010-02141 Improper access control in Apache Derby CVSS 3.0HIGH 7.5
  • TI-2018-01216 Improper access control in Apache Derby CVSS 3.1MEDIUM 5.3
  • TI-2005-04579 Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in… CVSS 2.0MEDIUM 5.0
  • TI-2006-06958 Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the… CVSS 2.0MEDIUM 4.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences