NetSight
IP …
critical9.1

CVE-2015-1832

Improper Restriction of XML External Entity Reference in Apace Derby

Impact

XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.derby:derby<= 10.11.1.110.12.1.1

Affected products

VendorProductAffected versions
ApacheDerby
Versions 10.1.1.0, 10.1.2.1, 10.1.3.1, 10.2.1.6, 10.2.2.0, 10.3.3.0

Weakness classification

CWE-399CWE-611

References