Apache Derby SQL Injection

GHSA-v7cq-pq7v-mh5v · CVE-2006-7217

Published May 1, 2022 · Modified Nov 28, 2024

Description

Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2006-7217
WEB https://github.com/apache/derby/commit/28c633d82a776c90fd1cd835a0b66d1c8916d31a
PACKAGE https://github.com/apache/derby
WEB https://svn.apache.org/viewvc?view=revision&revision=449869
WEB https://web.archive.org/web/20090406213028/http://www.novell.com/linux/security/advisories/suse_security_summary_report.html
WEB https://web.archive.org/web/20200301122517/https://issues.apache.org/jira/browse/DERBY-1858
WEB http://db.apache.org/derby/releases/release-10.2.1.6.html

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes