9.8

CVE-2022-46337: apache software foundation apache derby Injection

CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2022-46337DEBIAN-CVE-2022-46337CGA-225w-pxp9-r979
Published 20-11-2023Last modified 10-06-2025
Open JSON

Vulnerability summary

CVE-2022-46337 is a critical (CVSS 9.8) Injection vulnerability in apache software foundation apache derby. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
1.42%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 5
CGA-2772-96RW-FR4CCGA-6QQM-88W4-6W6MCGA-C453-74RV-2QCCCGA-CCH5-M8VC-66RHCGA-J64P-5VWG-QVV7

Timeline

  1. 20-11-2023
    PublishedVulnerability first disclosed.
  2. 10-06-2025
    Last modifiedVulnerability information updated.

Description

A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was visible to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and corrupt sensitive data and run sensitive database functions and procedures. Mitigation: Users should upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions should build their own Derby distribution from one of the release families to which the fix was backported: 10.16, 10.15, and 10.14. Those are the releases which correspond, respectively, with Java LTS versions 17, 11, and 8.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.42%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

0.00 pp

From 1.42% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard17 products
  • druid< 32.0.1-r1
  • druid-compat< 32.0.1-r1
  • hadoop-fips-3.3.6< 3.3.6-r15
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • hadoop-fips-3.5< 3.5.0-r11
Wolfi5 products
  • druid< 32.0.1-r1
  • druid-compat< 32.0.1-r1
  • logstash-integration-jdbc< 5.4.8-r0
  • spark-4.0-scala-2.13All versions (No fix recorded)
  • spark-4.1< 4.1.1-r5
Apache1 product
  • derby≥ 10.1.1.0, < 10.14.3.0 | ≥ 10.15.1.3, < 10.15.2.1 | 10.16.1.1
Apache software foundation1 product
  • apache derby≥ 10.1.1.0, ≤ 10.1.3.1 | ≥ 10.2.1.6, ≤ 10.2.2.0 | ≥ 10.3.1.4, ≤ 10.3.3.0 | ≥ 10.4.1.3, ≤ 10.4.2.0 | ≥ 10.5.1.1, ≤ 10.5.3.0 | ≥ 10.6.1.0, ≤ 10.6.2.1 | 10.7.1.1 | ≥ 10.8.1.2, ≤ 10.8.3.0 | 10.9.1.0 | ≥ 10.10.1.1, ≤ 10.10.2.0 | 10.11.1.1 | 10.12.1.1 | 10.13.1.1 | 10.14.2.0 | ≥ 10.15.1.3, ≤ 10.15.2.0 | 10.16.1.1
Debian1 product
  • derbyAll versions (No fix recorded) | < 10.14.2.0-3
Org.apache.derby1 product
  • derby≥ 10.1.1.0, ≤ 10.1.3.1 | ≥ 10.2.1.6, ≤ 10.2.2.0 | ≥ 10.3.1.4, ≤ 10.3.3.0 | ≥ 10.4.1.3, ≤ 10.4.2.0 | ≥ 10.5.1.1, ≤ 10.5.3.0 | ≥ 10.6.1.0, ≤ 10.6.2.1 | 10.7.1.1 | ≥ 10.8.1.2, ≤ 10.8.3.0 | 10.9.1.0 | ≥ 10.10.1.1, ≤ 10.10.2.0 | 10.11.1.1 | 10.12.1.1 | 10.13.1.1 | ≥ 10.14.2.0, < 10.14.2.1 | ≥ 10.16.1.1, < 10.16.1.2 | ≥ 10.15.1.3, < 10.15.2.1
Ubuntu1 product
  • derbyAll versions (No fix recorded)

7 vendors · 27 products

References

8 links