Detections
Analytics

Echo: org.apache.derby:derby: security update to 10.14.2.1

critical Tenable Cloud Security Plugin ID 462293

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby
 installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-
 authenticated Derby installations, this could also allow the attacker to execute malware which was visible
 to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't
 also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and
 corrupt sensitive data and run sensitive database functions and procedures. Mitigation: Users should
 upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions
 should build their own Derby distribution from one of the release families to which the fix was
 backported: 10.16, 10.15, and 10.14. Those are the releases which correspond, respectively, with Java LTS
 versions 17, 11, and 8. (CVE-2022-46337)

Solution

Update the org.apache.derby:derby library and its related packages to version 10.14.2.1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2022-46337

Plugin Details

Severity: Critical

ID: 462293

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.96

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-46337

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 11/20/2023

Reference Information

CVE: CVE-2022-46337