Описание
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 10.14.1.0-1ubuntu1 |
| cosmic | not-affected | 10.14.1.0-1ubuntu1 |
| devel | not-affected | 10.14.1.0-1ubuntu1 |
| disco | not-affected | 10.14.1.0-1ubuntu1 |
| eoan | not-affected | 10.14.1.0-1ubuntu1 |
| esm-apps/bionic | not-affected | 10.14.1.0-1ubuntu1 |
| esm-apps/focal | not-affected | 10.14.1.0-1ubuntu1 |
| esm-apps/jammy | not-affected | 10.14.1.0-1ubuntu1 |
| esm-apps/noble | not-affected | 10.14.1.0-1ubuntu1 |
Показывать по
EPSS
6.4 Medium
CVSS2
9.1 Critical
CVSS3
Связанные уязвимости
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apac ...
Improper Restriction of XML External Entity Reference in Apace Derby
Уязвимость системы управления базами данных Apache Derby, связанная с ошибками управления ресурсом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации или вызвать отказ в обслуживании
EPSS
6.4 Medium
CVSS2
9.1 Critical
CVSS3