XXE attack in Apache Derby



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2015-1832
CWE-ID CWE-611
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Apache Derby
Server applications / Database software

Vendor Apache Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) XXE attack

EUVDB-ID: #VU735

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-1832

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote user to conduct XXE attack.
The weakness exists due to XML external entity error. Via vectors involving XmlVTI and the XML datatype context-dependent attackers can view arbitrary files that may lead to denial of service.
Successful exploitation of the vulnerability can result in potentially sensitive information disclosure and denial of service on the vulnerable system.

Mitigation

Update to 10.12.1.1.

Vulnerable software versions

Apache Derby: 10.1.1 - 10.11.1.1

CPE2.3 External links

https://svn.apache.org/viewvc?view=revision&revision=1691461


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###