CVE-2010-2232: Improper Access Control in Apache Derby
Summary
CVE-2010-2232: Improper Access Control in Apache Derby. Affects org.apache.derby:derby versions >= 10.1.2.1, < 10.4.2.0. Fixed in 10.4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Derby is a relational database management system implemented entirely in Java. It provides a small footprint, yet fully functional, database engine that can be embedded into Java applications or run in a client-server mode. The vulnerability affects versions 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3 of Apache Derby. These versions allow an attacker to overwrite an existing file during the export processing.
Vulnerability Detail
The vulnerability arises due to improper access control in the export processing functionality of Apache Derby. An attacker can exploit this vulnerability to overwrite an existing file, potentially leading to unauthorized access, data loss, or other malicious activities. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 10.17.1.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.4.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, Apache Derby versions 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3 are vulnerable to improper access control, allowing an attacker to overwrite existing files. It is recommended to upgrade to version 10.4.2.0 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.derby:derby →
FAQ
Apache Derby is a relational database management system implemented in Java.
Versions 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3 of Apache Derby are affected.
The vulnerability allows an attacker to overwrite existing files, potentially leading to unauthorized access or data loss.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, upgrade to version 10.4.2.0 or later of Apache Derby.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.derby:derby.
