Read the docs
TI-2006-06958 Aliases CVE-2006-7217GHSA-v7cq-pq7v-mh5v

Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the…

Priority LOW 23CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.

Why it matters now

EPSS 0.01953 80th percentileScored 2026-11-07
Fix Fixed org.apache.derby:derby (Maven): 10.2.1.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.derby:derby (Maven)before 10.2.1.610.2.1.6Patch availableGHSA-v7cq-pq7v-mh5v
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.derby:derby (Maven) Vendor— Affected before 10.2.1.6 Fixed in 10.2.1.6 Patch available GHSA-v7cq-pq7v-mh5v

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:derby:10.1.1.0:*:*:*:*:*:*:*10.1.1.0VulnerableApache
cpe:2.3:a:apache:derby:10.1.2.1:*:*:*:*:*:*:*10.1.2.1VulnerableApache
cpe:2.3:a:apache:derby:10.1.3.1:*:*:*:*:*:*:*10.1.3.1VulnerableApache
  • cpe:2.3:a:apache:derby:10.1.1.0:*:*:*:*:*:*:* Versions 10.1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:derby:10.1.2.1:*:*:*:*:*:*:* Versions 10.1.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:derby:10.1.3.1:*:*:*:*:*:*:* Versions 10.1.3.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-v7cq-pq7v-mh5v org.apache.derby:derby (Maven) Fixed in 10.2.1.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-7217
  2. 2026-10-03 Alias added: GHSA-v7cq-pq7v-mh5v

References

Patch 1

Advisory 2

Other 6

  • TI-2015-01645 XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before… CVSS 3.0CRITICAL 9.1
  • TI-2022-22882 Apache Derby: LDAP injection vulnerability in authenticator CVSS 3.1CRITICAL 9.8
  • TI-2010-02141 Improper access control in Apache Derby CVSS 3.0HIGH 7.5
  • TI-2018-01216 Improper access control in Apache Derby CVSS 3.1MEDIUM 5.3
  • TI-2005-04579 Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in… CVSS 2.0MEDIUM 5.0
  • TI-2006-06957 Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table… CVSS 2.0MEDIUM 4.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences