PT-2005-5510 · Apache · Apache Derby

Katherine Marsden

·

Published

2005-12-31

·

Updated

2024-06-15

·

CVE-2005-4849

CVSS v2.0

5.0

Medium

VectorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Apache Derby versions prior to 10.1.2.1
Description: The issue exposes the user and password attributes in cleartext via the RDBNAM parameter of the ACCSEC command and the output of the DatabaseMetaData.getURL function, allowing attackers to obtain sensitive information.
Recommendations: For Apache Derby versions prior to 10.1.2.1, update to version 10.1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ACCSEC command and the DatabaseMetaData.getURL function to minimize the risk of exploitation. Avoid using the user and password attributes in cleartext until the issue is resolved.

Fix

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2005-4849
GHSA-RP7R-79RM-2758
OPENSUSE-SU-2024:10092-1

Affected Products

Apache Derby