CVE-2005-4849
Apache Derby exposes user and password attributes
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
Exploit likelihood
What each source reports
NVD Score used
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
- Record
CVE-2005-4849- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
- Record
CVE-2005-4849- Updated
- 2026-11-02
EUVDEUVD-2022-5206 No score
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
- Record
EUVD-2022-5206- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rp7r-79rm-2758 No score
Apache Derby exposes user and password attributes
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
- Record
GHSA-rp7r-79rm-2758- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-rp7r-79rm-2758 No score
Apache Derby exposes user and password attributes
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
- Record
GHSA-rp7r-79rm-2758- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10092-1 No score
derby-10.11.1.1-3.2 on GA media
These are all security issues fixed in the derby-10.11.1.1-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10092-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.derby:derbyMaven |
through 10.1.1.0 | 10.1.2.1 |
org.apache.derby:derbyMaven |
before 10.1.2.1, plus listed versions 10.1.1.0 |
10.1.2.1 |
derbyopenSUSE:Tumbleweed |
before 10.11.1.1-3.2 | 10.11.1.1-3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-4849 is a medium vulnerability (CVSS 5.0) in Apache Derby, published December 31, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.45%, the 84th percentile. Fixed in org.apache.derby:derby 10.1.2.1.
References
issues.apache.org/jira/browse/DERBY-559
db.apache.org/derby/releases/release-10.1.2.1.html
nvd.nist.gov/vuln/detail/CVE-2005-4849
github.com/apache/derby/commit/09a7325f75a4f96a7735e46c9723930f88ea2613
Show 8 moreShow less
svn.apache.org/viewvc?view=revision&revision=289672
suse.com/security/cve/CVE-2005-4849