CVE-2005-4849

Published: Dec 31, 2005Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.

Affected (1)

Products: Apache: Derby

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Derby	Up to 10.1.1.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://db.apache.org/derby/releases/release-10.1.2.1.html

Source: cve@mitre.org

Patch

http://issues.apache.org/jira/browse/DERBY-530

Source: cve@mitre.org

http://issues.apache.org/jira/browse/DERBY-559

Source: cve@mitre.org

http://db.apache.org/derby/releases/release-10.1.2.1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://issues.apache.org/jira/browse/DERBY-530

Source: af854a3a-2127-422b-91ae-364da2661108

http://issues.apache.org/jira/browse/DERBY-559

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.