Every CVE Search/ Get API key

CVE-2018-1313

Improper Access Control in Apache Derby

5.3 MediumPublic exploitFix available

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

4.59%Down 12.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
CVE-2018-1313
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
CVE-2018-1313
Updated
2026-11-02
EUVDEUVD-2022-2274 No score

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
EUVD-2022-2274
Updated
2026-11-03
GitHub AdvisoriesGHSA-42xw-p62x-hwcf 5.3

Improper Access Control in Apache Derby

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
GHSA-42xw-p62x-hwcf
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-284
Updated
2026-11-02
OSV 5.3

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
CVE-2018-1313
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-1313 5.3

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
DEBIAN-CVE-2018-1313
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-42xw-p62x-hwcf 5.3

Improper Access Control in Apache Derby

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
GHSA-42xw-p62x-hwcf
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVOESA-2022-1780 5.3

derby security update

Apache Derby, an Apache DB sub-project, is a relational database implemented entirely in Java. Some key advantages include a small footprint, conformance to Java, JDBC, and SQL standards and embedded JDBC driver.

Security Fix(es):

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the users control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.(CVE-2018-1313)

Record
OESA-2022-1780
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-1313 5.3

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.

Record
UBUNTU-CVE-2018-1313
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2018-1313 No score

CVE-2018-1313 in io.root.org.apache.derby:derby - Patched by Root

Root has patched CVE-2018-1313 in the io.root.org.apache.derby:derby package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2018-1313
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.derby:derby
Maven
 10.3.1.4 to 10.14.1.0
10.14.2.0
derby
Debian:12
 before 10.14.2.0-1
10.14.2.0-1
derby
Debian:13
 before 10.14.2.0-1
10.14.2.0-1
derby
Debian:14
 before 10.14.2.0-1
10.14.2.0-1
org.apache.derby:derby
Maven
 10.3.1.4 up to 10.14.2.0, plus listed versions
10.10.1.110.10.2.010.11.1.110.12.1.110.13.1.1
Show 13 moreShow less
10.14.1.010.3.2.110.4.1.310.4.2.010.5.3.010.5.3.0_110.6.1.010.6.2.110.7.1.110.8.1.210.8.2.210.8.3.010.9.1.0
10.14.2.0
derby
openEuler:20.03-LTS-SP1
 before 10.13.1.1-3.oe1
10.13.1.1-3.oe1
derby
Ubuntu:16.04:LTS
 All versions, plus listed versions
10.10.2.0-1
 None known
derby
Ubuntu:18.04:LTS
 All versions, plus listed versions
10.13.1.1-2ubuntu110.14.1.0-1ubuntu1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubtafamace/CVE-2018-13132018-11-19

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1313 is a medium vulnerability (CVSS 5.3) in Apache Derby, published May 7, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.59%, the 91st percentile. Fixed in org.apache.derby:derby 10.14.2.0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open