← Back

CVE-2015-1832

nvd nist
Published: Oct 3, 2016Modified: May 6, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.

Affected (20)

Products: Apache: Derby
Apache
1 product
Derby
Configuration A
20 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Derby
Version 10.1.1.0
Derby
Version 10.1.2.1
Derby
Version 10.1.3.1
Derby
Version 10.10.1.1
Derby
Version 10.10.2.0
Derby
Version 10.11.1.1
Derby
Version 10.2.1.6
Derby
Version 10.2.2.0
Derby
Version 10.3.3.0
Derby
Version 10.4.1.3
Derby
Version 10.4.2.0
Derby
Version 10.5.1.1
Derby
Version 10.5.3.0
Derby
Version 10.6.1.0
Derby
Version 10.6.2.1
Derby
Version 10.7.1.1
Derby
Version 10.8.1.2
Derby
Version 10.8.2.2
Derby
Version 10.8.3.0
Derby
Version 10.9.1.0

Related CWEs

CWE-399
CWE-399
CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (26)

Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party AdvisoryVDB Entry
Source: secalert@redhat.com
Issue Tracking
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Issue Tracking
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.