GHSA-wr69-g62g-2r9h

Suggest an improvement
Source
https://github.com/advisories/GHSA-wr69-g62g-2r9h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wr69-g62g-2r9h/GHSA-wr69-g62g-2r9h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wr69-g62g-2r9h
Aliases
Published
2022-05-13T01:14:26Z
Modified
2023-11-08T03:57:50.873765Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Improper Restriction of XML External Entity Reference in Apace Derby
Details

XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.

Database specific 
{
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-611"
    ],
    "github_reviewed_at": "2022-07-06T20:23:16Z",
    "nvd_published_at": "2016-10-03T21:59:00Z"
}
References

Affected packages

Maven / org.apache.derby:derby

Package

Name
org.apache.derby:derby
View open source insights on deps.dev
Purl
pkg:maven/org.apache.derby/derby

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.12.1.1

Affected versions

10.*

10.1.1.0
10.1.2.1
10.1.3.1
10.2.1.6
10.2.2.0
10.3.1.4
10.3.2.1
10.4.1.3
10.4.2.0
10.5.3.0
10.5.3.0_1
10.6.1.0
10.6.2.1
10.7.1.1
10.8.1.2
10.8.2.2
10.8.3.0
10.9.1.0
10.10.1.1
10.10.2.0
10.11.1.1

Database specific

last_known_affected_version_range

"<= 10.11.1.1"