CVE-2005-4849 json
Apache Derby exposes user and password attributes
published 2005-12-31 20 y ago modified 2026-06-16 4 mo ago also GHSA-rp7r-79rm-2758 , EUVD-2022-5206
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 84%
- public exploits
- 0
- none known
Summary
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
Patch / fix
- maven org.apache.derby:derby 10.1.2.1
- derby openSUSE Tumbleweed 10.11.1.1-3.2
opensuse advisories openSUSE-SU-2024:10092-1
Exploit prediction
2.45% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.derby:derby | <10.1.2.1 |
10.1.2.1 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
db.apache.org
/derby/releases/release-10.1.2.1.html
web, patch
-
github.com
/apache/derby/commit/09a7325f75a4f96a7735e46c9723930f88ea2613
web
-
github.com
/apache/derby/commit/82d721fd53e30dbb86d6d742c085030985091968
web
-
github.com
/apache/derby/commit/fd24a7590ff5426bac68303fbeca07dbc5067412
web
-
issues.apache.org
/jira/browse/DERBY-559
web
-
issues.apache.org
/jira/browse/DERBY-530
web
-
nvd.nist.gov
/vuln/detail/CVE-2005-4849
advisory
-
github.com
/apache/derby
package
-
svn.apache.org
/viewvc?view=revision&revision=289672
web
Sources
- CVE List CVE-2005-4849
- GitHub Advisory GHSA-rp7r-79rm-2758
- NVD CVE-2005-4849
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.