CVE-2006-7217
Apache Derby SQL Injection
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
Exploit likelihood
What each source reports
NVD Score used
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
CVE-2006-7217- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
CVE-2006-7217- Updated
- 2026-11-02
EUVDEUVD-2022-5308 No score
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
EUVD-2022-5308- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7cq-pq7v-mh5v No score
Apache Derby SQL Injection
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
GHSA-v7cq-pq7v-mh5v- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-v7cq-pq7v-mh5v No score
Apache Derby SQL Injection
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
GHSA-v7cq-pq7v-mh5v- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10092-1 No score
derby-10.11.1.1-3.2 on GA media
These are all security issues fixed in the derby-10.11.1.1-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10092-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.derby:derbyMaven |
before 10.2.1.6 | 10.2.1.6 |
org.apache.derby:derbyMaven |
before 10.2.1.6, plus listed versions 10.1.1.010.1.2.110.1.3.1 |
10.2.1.6 |
derbyopenSUSE:Tumbleweed |
before 10.11.1.1-3.2 | 10.11.1.1-3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-7217 is a medium vulnerability (CVSS 4.0) in Apache Derby, published July 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.95%, the 80th percentile. Fixed in org.apache.derby:derby 10.2.1.6.
References
novell.com/linux/security/advisories/suse_security_summary_report.html
db.apache.org/derby/releases/release-10.2.1.6.html
issues.apache.org/jira/browse/DERBY-1858
secunia.com/advisories/28636
nvd.nist.gov/vuln/detail/CVE-2006-7217
github.com/apache/derby/commit/28c633d82a776c90fd1cd835a0b66d1c8916d31a
Show 9 moreShow less
svn.apache.org/viewvc?view=revision&revision=449869
web.archive.org/web/20090406213028/http://www.novell.com/linux/security/advisories/suse_security_summary_report.html
suse.com/security/cve/CVE-2005-4849