GitHub Advisoryadvisory · Maven

GHSA-rp7r-79rm-2758 Apache Derby exposes user and password attributes

MEDIUM Published 2022-05-01 Modified 2022-05-25 Official page ↗
Aliases
CVE-2005-4849
Ecosystem
Maven
Packages
org.apache.derby:derby
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2022-05-25

Affected packages

• Maven org.apache.derby:derby: < 10.1.2.1 → fixed in 10.1.2.1

Description

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.

Related

Alias · CVE (1)

  • CVE-2005-4849 Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References