CVE-2022-46337

🗓️ 20 Nov 2023 08:49:38Reported by apacheType

A username bypass vuln could fill up disk with junk Derby dbs in LDAP-authenticated installations, allowing malware execution and sensitive data access

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to remote attack due to Apache Derby (CVE-2022-46337)	1 Apr 202418:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for June 2024 - Multiple CVEs addressed	7 Aug 202405:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management	14 Feb 202408:43	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Derby affects IBM Cloud Pak System [CVE-2022-46337]	6 Feb 202419:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	13 Mar 202410:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management is vulnerable to Apache Derby security bypass [CVE-2022-46337]	2 Apr 202407:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operations Analytics Predictive Insights.	27 Mar 202415:37	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Derby affects IBM Spectrum Control [CVE-2022-46337]	8 Jul 202409:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for AIOps	31 Jan 202419:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Apache Derby	1 Feb 202422:59	–	ibm

NVD

Vulners

Node

apache derbyRange10.1.1.0–10.14.3.0

apache derbyRange10.15.1.3–10.15.2.1

apache derbyMatch10.16.1.1

[
  {
    "collectionURL": "https://repo1.maven.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.derby",
    "product": "Apache Derby",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "10.1.3.1",
        "status": "affected",
        "version": "10.1.1.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.2.2.0",
        "status": "affected",
        "version": "10.2.1.6",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.3.3.0",
        "status": "affected",
        "version": "10.3.1.4",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.4.2.0",
        "status": "affected",
        "version": "10.4.1.3",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.5.3.0",
        "status": "affected",
        "version": "10.5.1.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.6.2.1",
        "status": "affected",
        "version": "10.6.1.0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.7.1.1"
      },
      {
        "lessThanOrEqual": "10.8.3.0",
        "status": "affected",
        "version": "10.8.1.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.9.1.0"
      },
      {
        "lessThanOrEqual": "10.10.2.0",
        "status": "affected",
        "version": "10.10.1.1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.11.1.1"
      },
      {
        "status": "affected",
        "version": "10.12.1.1"
      },
      {
        "status": "affected",
        "version": "10.13.1.1"
      },
      {
        "status": "affected",
        "version": "10.14.2.0"
      },
      {
        "lessThanOrEqual": "10.15.2.0",
        "status": "affected",
        "version": "10.15.1.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.16.1.1"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/q23kvvtoohgzwybxpwozmvvk17rp0td3

10 Jun 2025 14:15Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.00047

SSVC

CWE-74