CVE-2006-7217
Apache Derby SQL Injection
CVE-2006-7217 is a medium vulnerability (CVSS 4.0) in Apache Derby, published July 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.95%, the 80th percentile. Fixed in org.apache.derby:derby 10.2.1.6.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 1.95%EPSS, 80th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
10.2.1.6org.apache.derby:derby +2 more
Description
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.derby:derbyMaven | before 10.2.1.6 | 10.2.1.6 |
org.apache.derby:derbyMaven | before 10.2.1.6, plus listed versions 10.1.1.010.1.2.110.1.3.1 | 10.2.1.6 |
derbyopenSUSE:Tumbleweed From an advisory covering 4 CVEs | before 10.11.1.1-3.2 | 10.11.1.1-3.2 |
What each source reports
NVD Score used
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
CVE-2006-7217- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
CVE-2006-7217- Updated
- 2026-11-02
EUVDEUVD-2022-5308No score
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
EUVD-2022-5308- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7cq-pq7v-mh5vNo score
Apache Derby SQL Injection
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
GHSA-v7cq-pq7v-mh5v- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-v7cq-pq7v-mh5vNo score
Apache Derby SQL Injection
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Record
GHSA-v7cq-pq7v-mh5v- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10092-1No score
derby-10.11.1.1-3.2 on GA media
These are all security issues fixed in the derby-10.11.1.1-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10092-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
novell.com/linux/security/advisories/suse_security_summary_report.html
db.apache.org/derby/releases/release-10.2.1.6.html
issues.apache.org/jira/browse/DERBY-1858
secunia.com/advisories/28636
nvd.nist.gov/vuln/detail/CVE-2006-7217
github.com/apache/derby/commit/28c633d82a776c90fd1cd835a0b66d1c8916d31a
Show 9 moreShow less
svn.apache.org/viewvc?view=revision&revision=449869
web.archive.org/web/20090406213028/http://www.novell.com/linux/security/advisories/suse_security_summary_report.html
suse.com/security/cve/CVE-2005-4849