1. Home
  2. CVE Database
  3. CVE-2005-4849
MEDIUM · 5.0

CVE-2005-4849

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function...

Vulnerability Description

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ApacheDerby<= 10.1.1.0

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2005-4849?

CVE-2005-4849 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function...

How severe is CVE-2005-4849?

CVE-2005-4849 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2005-4849?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Derby.