CVE-2010-2232 Improper Access Control in Apache Derby
An attacker can overwrite existing files via export processing in Apache Derby, potentially compromising data integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-2232?
CVE-2010-2232 is a high-severity path traversal vulnerability in Apache Derby, published on 23 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
Weakness: CWE-284
Which versions are affected by CVE-2010-2232?
2 open source packages ship an affected version, including org.apache.derby:derby. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.derby:derby Maven | From 10.1.2.1 | 10.4.2.0 |
org.apache.derby:derby Maven | From 10.1.2.1 | 10.4.2.0 |
Products include Apache Derby.
How do I fix CVE-2010-2232?
Upgrade org.apache.derby:derby to 10.4.2.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2010-2232 being exploited?
There is no known exploitation of CVE-2010-2232 in the wild and no public exploit code.
Other vulnerabilities in Apache Derby
- CVE-2022-46337 Apache Derby: LDAP injection vulnerability in authenticator
- CVE-2015-1832 Improper Restriction of XML External Entity Reference in Apace Derby
- CVE-2018-1313 Improper Access Control in Apache Derby
- CVE-2005-4849 Apache Derby exposes user and password attributes
- CVE-2006-7216 Missing authorization in n/a
Sources
Also known as GHSA-xprw-xvvm-vqmv.