Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2018-1313

EPSS 0.77% · P74
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2018-1313

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Derby 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Derby是美国阿帕奇（Apache）基金会的一套开源的数据库管理系统。 Apache Derby 10.3.1.4版本至10.14.1.0版本中存在权限许可和访问控制问题漏洞,该漏洞源于程序没有正确的校验接收到的网络数据包。远程攻击者可通过发送特制的网络数据包利用该漏洞启动用户控制的数据库（位置和内容）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Apache Software FoundationApache Derby 10.3.1.4 to 10.14.1.0 -

II. Public POCs for CVE-2018-1313

#POC DescriptionSource LinkShenlong Link
1Nonehttps://github.com/tafamace/CVE-2018-1313POC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2018-1313

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: Apache Derby
Same vendor: Apache Software Foundation

V. Comments for CVE-2018-1313

No comments yet

Leave a comment