Arbitrary File Overwrite Affecting org.apache.derby:derby Open this link in a new tab package, versions [,10.6.2.1)
Do your applications use this vulnerable package?
17 Nov 2017
11 Jul 2007
How to fix?
org.apache.derby:derby to version 10.6.2.1 or higher.
org.apache.derby:derby is a pure Java, standards-based relational database engine.
Affected versions of the package are vulnerable to Arbitrary File Overwrite. In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.