Read the docs
TI-2022-22882 Aliases CVE-2022-46337GHSA-rcjc-c4pj-xxrp

Apache Derby: LDAP injection vulnerability in authenticator

Priority MEDIUM 52CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was visible to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and corrupt sensitive data and run sensitive database functions and procedures. Mitigation: Users should upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions should build their own Derby distribution from one of the release families to which the fix was backported: 10.16, 10.15, and 10.14. Those are the releases which correspond, respectively, with Java LTS versions 17, 11, and 8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01418 72nd percentileScored 2026-11-07
Fix Fixed org.apache.derby:derby (Maven): 10.14.2.1, 10.16.1.2, 10.15.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Derby10.1.1.0 – 10.1.3.1; 10.2.1.6 – 10.2.2.0; 10.3.1.4 – 10.3.3.0; 10.4.1.3 – 10.4.2.0; 10.5.1.1 – 10.5.3.0; 10.6.1.0 – 10.6.2.1; 10.7.1.1; 10.8.1.2 – 10.8.3.0; 10.9.1.0; 10.10.1.1 – 10.10.2.0; 10.11.1.1; 10.12.1.1; 10.13.1.1; 10.14.2.0; 10.15.1.3 – 10.15.2.0; 10.16.1.1—No fix listedCNA
—org.apache.derby:derby (Maven)10.1.1.0 – 10.1.3.1—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.2.1.6 – 10.2.2.0—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.3.1.4 – 10.3.3.0—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.4.1.3 – 10.4.2.0—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.5.1.1 – 10.5.3.0—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.6.1.0 – 10.6.2.1—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)——No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.8.1.2 – 10.8.3.0—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)——No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.10.1.1 – 10.10.2.0—No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)——No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)——No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)——No fix listedGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.14.2.0 to before 10.14.2.110.14.2.1Patch availableGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.16.1.1 to before 10.16.1.210.16.1.2Patch availableGHSA-rcjc-c4pj-xxrp
—org.apache.derby:derby (Maven)10.15.1.3 to before 10.15.2.110.15.2.1Patch availableGHSA-rcjc-c4pj-xxrp
  • Apache Derby VendorApache Affected 10.1.1.0 – 10.1.3.1; 10.2.1.6 – 10.2.2.0; 10.3.1.4 – 10.3.3.0; 10.4.1.3 – 10.4.2.0; 10.5.1.1 – 10.5.3.0; 10.6.1.0 – 10.6.2.1; 10.7.1.1; 10.8.1.2 – 10.8.3.0; 10.9.1.0; 10.10.1.1 – 10.10.2.0; 10.11.1.1; 10.12.1.1; 10.13.1.1; 10.14.2.0; 10.15.1.3 – 10.15.2.0; 10.16.1.1 Fixed in — No fix listed CNA
  • org.apache.derby:derby (Maven) Vendor— Affected 10.1.1.0 – 10.1.3.1 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.2.1.6 – 10.2.2.0 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.3.1.4 – 10.3.3.0 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.4.1.3 – 10.4.2.0 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.5.1.1 – 10.5.3.0 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.6.1.0 – 10.6.2.1 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.8.1.2 – 10.8.3.0 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.10.1.1 – 10.10.2.0 Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.14.2.0 to before 10.14.2.1 Fixed in 10.14.2.1 Patch available GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.16.1.1 to before 10.16.1.2 Fixed in 10.16.1.2 Patch available GHSA-rcjc-c4pj-xxrp
  • org.apache.derby:derby (Maven) Vendor— Affected 10.15.1.3 to before 10.15.2.1 Fixed in 10.15.2.1 Patch available GHSA-rcjc-c4pj-xxrp

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:*10.1.1.0 to before 10.14.3.0; 10.15.1.3 to before 10.15.2.1VulnerableApache
cpe:2.3:a:apache:derby:10.16.1.1:*:*:*:*:*:*:*10.16.1.1VulnerableApache
  • cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:* Versions 10.1.1.0 to before 10.14.3.0; 10.15.1.3 to before 10.15.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:derby:10.16.1.1:*:*:*:*:*:*:* Versions 10.16.1.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-rcjc-c4pj-xxrp org.apache.derby:derby (Maven) Fixed in 10.14.2.1 Advisory →
  • Fix · GHSA-rcjc-c4pj-xxrp org.apache.derby:derby (Maven) Fixed in 10.16.1.2 Advisory →
  • Fix · GHSA-rcjc-c4pj-xxrp org.apache.derby:derby (Maven) Fixed in 10.15.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46337
  2. 2026-10-03 Alias added: GHSA-rcjc-c4pj-xxrp

References

Advisory 2

Other 2

  • TI-2015-01645 XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before… CVSS 3.0CRITICAL 9.1
  • TI-2010-02141 Improper access control in Apache Derby CVSS 3.0HIGH 7.5
  • TI-2018-01216 Improper access control in Apache Derby CVSS 3.1MEDIUM 5.3
  • TI-2005-04579 Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in… CVSS 2.0MEDIUM 5.0
  • TI-2006-06958 Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the… CVSS 2.0MEDIUM 4.0
  • TI-2006-06957 Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table… CVSS 2.0MEDIUM 4.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences