CVE-2005-4849: Apache Derby Exposes User and Password Attributes
Summary
CVE-2005-4849: Apache Derby exposes user and password attributes. Affects org.apache.derby:derby versions < 10.1.2.1. Fixed in 10.1.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Derby is an open-source relational database management system implemented entirely in Java. It provides a small footprint, yet fully functional SQL database engine that can be embedded into Java applications or run as a standalone server. Derby is widely used in various Java-based applications and frameworks. However, prior to version 10.1.2.1, Derby exposes the user and password attributes in cleartext, making them vulnerable to unauthorized access.
Vulnerability Detail
The vulnerability in Apache Derby arises from the exposure of the user and password attributes. This can occur through the RDBNAM parameter of the ACCSEC command or the output of the DatabaseMetaData.getURL function. Attackers with context-dependent access can exploit this flaw to obtain sensitive information, such as user credentials. The impact of this vulnerability can be significant, as it compromises the security of the database and potentially allows unauthorized access to sensitive data.
How To Fix
Latest published version: 10.17.1.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.1.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider implementing additional security measures, such as encrypting the user and password attributes or using a secure authentication mechanism. However, these workarounds may require modifications to the application code and should be thoroughly tested to ensure they do not introduce any other vulnerabilities.
Conclusion
The vulnerability in Apache Derby that exposes user and password attributes can have serious security implications. It is crucial to upgrade to the latest version of Apache Derby (10.1.2.1 or later) to mitigate this vulnerability. Additionally, implementing additional security measures and thoroughly testing any workarounds can further enhance the security of the database. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.apache.derby:derby →
FAQ
Apache Derby is an open-source relational database management system implemented entirely in Java. It provides a small footprint, yet fully functional SQL database engine that can be embedded into Java applications or run as a standalone server.
This vulnerability exposes the user and password attributes in cleartext, allowing attackers to obtain sensitive information. It compromises the security of the database and potentially enables unauthorized access to sensitive data.
To fix this vulnerability, it is recommended to upgrade to Apache Derby version 10.1.2.1 or later. This version includes the necessary security patches to prevent the exposure of user and password attributes.
As a workaround, users can consider implementing additional security measures, such as encrypting the user and password attributes or using a secure authentication mechanism. However, these workarounds may require modifications to the application code and should be thoroughly tested.
For more information about this vulnerability, you can refer to the official Apache Derby documentation or consult the CVE entry (CVE-2005-4849).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.derby:derby.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
