CVE-2018-1313 Improper Access Control in Apache Derby
Attackers can force the Derby Network Server to load a malicious database, potentially executing code if the default permissive security policy is used.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1313?
CVE-2018-1313 is a medium-severity path traversal vulnerability in Oracle Weblogic Server, published on 7 May 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.
Which versions are affected by CVE-2018-1313?
2 open source packages ship an affected version, including org.apache.derby:derby. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.derby:derby Maven | From 10.3.1.4 | 10.14.2.0 |
org.apache.derby:derby Maven | From 10.3.1.4 | 10.14.2.0 |
Products include Apache Derby, Oracle Weblogic Server.
How do I fix CVE-2018-1313?
Upgrade org.apache.derby:derby to 10.14.2.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1313 being exploited?
There is no known exploitation of CVE-2018-1313 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Weblogic Server
- CVE-2022-46337 Apache Derby: LDAP injection vulnerability in authenticator
- CVE-2015-1832 Improper Restriction of XML External Entity Reference in Apace Derby
- CVE-2010-2232 Improper Access Control in Apache Derby
- CVE-2005-4849 Apache Derby exposes user and password attributes
- CVE-2006-7216 Missing authorization in n/a
Sources
Also known as DEBIAN-CVE-2018-1313, GHSA-42xw-p62x-hwcf, OESA-2022-1780, UBUNTU-CVE-2018-1313.