Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2005-4849HistoryOct 03, 2022 - 4:22 p.m.
CVE-2005-4849
2022-10-0316:22:45
Debian Security Bug Tracker
security-tracker.debian.org
7
apache derby
security vulnerability
cleartext
accsec command
databasemetadata
sensitive information
unix
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
21.9%
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | derby | < 10.14.2.0-2 | derby_10.14.2.0-2_all.deb |
| Debian | 11 | all | derby | < 10.14.2.0-2 | derby_10.14.2.0-2_all.deb |
| Debian | 999 | all | derby | < 10.14.2.0-3 | derby_10.14.2.0-3_all.deb |
| Debian | 13 | all | derby | < 10.14.2.0-3 | derby_10.14.2.0-3_all.deb |
Related
veracode
veracode
Information Disclosure
2018-11-14 03:10:42
github
github
Apache Derby exposes user and password attributes
2022-05-01 02:31:27
cve
cve
CVE-2005-4849
2022-10-03 16:22:45
osv
osv
Apache Derby exposes user and password attributes
2022-05-01 02:31:27
nvd
nvd
CVE-2005-4849
2005-12-31 05:00:00
cvelist
cvelist
CVE-2005-4849
2022-10-03 16:22:45
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
21.9%
Related for DEBIANCVE:CVE-2005-4849