CVE-2015-1832

Critical

Published: 03/10/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An XXE vulnerability in the SqlXmlUtil code in Apache Derby before version 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service via vectors involving XmlVTI and the XML datatype.

Risk Assessment

Attackers may gain access to sensitive data or cause resource exhaustion, potentially leading to application downtime.

Recommendation

It is recommended to upgrade Apache Derby to version 10.12.1.1 or later and to implement a Java Security Manager to mitigate the risk.

Original NVD description (English source)

XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.