Description

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.

Remediation

References

http://db.apache.org/derby/releases/release-10.1.2.1.html

http://issues.apache.org/jira/browse/DERBY-530

http://issues.apache.org/jira/browse/DERBY-559

Related Vulnerabilities

CVE-2022-4772 Vulnerability in maven package com.github.dgarijo:widoco

CVE-2013-2251 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2019-17359 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk15on

CVE-2019-10791 Vulnerability in npm package promise-probe

CVE-2018-3720 Vulnerability in npm package assign-deep

Severity

Critical

Classification

CWE-200

Tags

Patch