CVE-2015-1832
Improper Restriction of XML External Entity Reference in Apace Derby
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
CVE-2015-1832- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-399, CWE-611
- Updated
- 2026-11-02
CVE List No score
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
CVE-2015-1832- Updated
- 2026-11-02
EUVDEUVD-2022-5628 No score
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
EUVD-2022-5628- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wr69-g62g-2r9h
Improper Restriction of XML External Entity Reference in Apace Derby
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
GHSA-wr69-g62g-2r9h- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
CVE-2015-1832- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1832
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
DEBIAN-CVE-2015-1832- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-wr69-g62g-2r9h
Improper Restriction of XML External Entity Reference in Apace Derby
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
GHSA-wr69-g62g-2r9h- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1832
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
- Record
UBUNTU-CVE-2015-1832- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0385 No score
Updated derby packages fix security vulnerability
Apache Derby could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML datatype and XmlVTI. An attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service (CVE-2015-1832).
- Record
MGASA-2016-0385- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10092-1 No score
derby-10.11.1.1-3.2 on GA media
These are all security issues fixed in the derby-10.11.1.1-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10092-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.derby:derbyMaven |
through 10.11.1.1 | 10.12.1.1 |
derbyDebian:12 |
before 10.13.1.1-1 | 10.13.1.1-1 |
derbyDebian:13 |
before 10.13.1.1-1 | 10.13.1.1-1 |
derbyDebian:14 |
before 10.13.1.1-1 | 10.13.1.1-1 |
org.apache.derby:derbyMaven |
before 10.12.1.1, plus listed versions 10.1.1.010.1.2.110.1.3.110.10.1.110.10.2.0 Show 16 moreShow less10.11.1.110.2.1.610.2.2.010.3.1.410.3.2.110.4.1.310.4.2.010.5.3.010.5.3.0_110.6.1.010.6.2.110.7.1.110.8.1.210.8.2.210.8.3.010.9.1.0 |
10.12.1.1 |
derbyMageia:5 |
before 10.10.2.0-1.1.mga5 | 10.10.2.0-1.1.mga5 |
derbyUbuntu:16.04:LTS |
All versions, plus listed versions 10.10.2.0-1 |
None known |
derbyopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 10.11.1.1-3.2 | 10.11.1.1-3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1832 is a critical vulnerability (CVSS 9.1) in Apache Derby, published October 3, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.2%, the 96th percentile. Fixed in org.apache.derby:derby 10.12.1.1.
References
securityfocus.com/bid/93132
lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
Show 24 moreShow less
oracle.com/security-alerts/cpuapr2020.html
issues.apache.org/jira/browse/DERBY-6807
www-01.ibm.com/support/docview.wss?uid=swg21990100
svn.apache.org/viewvc?view=revision&revision=1691461
nvd.nist.gov/vuln/detail/CVE-2015-1832
github.com/advisories/GHSA-wr69-g62g-2r9h
security-tracker.debian.org/tracker/CVE-2015-1832
advisories.mageia.org/MGASA-2016-0385.html
bugs.mageia.org/show_bug.cgi?id=19590
lists.opensuse.org/opensuse-updates/2016-10/msg00051.html
ubuntu.com/security/CVE-2015-1832
cve.org/CVERecord?id=CVE-2015-1832
suse.com/security/cve/CVE-2005-4849