GHSA-42xw-p62x-hwcf · Severity: medium · Ecosystem: maven — Improper Access Control in Apache Derby
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.
Conclusion & alert: CVE-2018-1313 is rated Moderate Risk (56.5/100): CVSS Medium severity, with high exploitation likelihood (EPSS 4.50%, 90th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +3.73% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.77% | 4.50% | +3.73% |
| 2 | 2026-03-05 | 0.71% | 0.77% | +0.06% |
| 3 | 2025-12-28 | — | 0.71% | — |
Full EPSS history (29 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.3 | 3.1 | MEDIUM |
|
1.6 | 3.6 | [email protected] |
| 3.5 | 2.0 | LOW |
|
6.8 | 2.9 | [email protected] |
GHSA-42xw-p62x-hwcf · Severity: medium · Ecosystem: maven — Improper Access Control in Apache Derby
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2018-1313 not yet assigned priority: Debian including 1 source packages (derby), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2018-1313 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2018-1313 |
suse
|
medium | — | https://www.suse.com/security/cve/CVE-2018-1313/ |
ubuntu
|
medium | CVE-2018-1313 medium priority: Ubuntu including 1 source packages (derby), 20 status rows across 20 suites (artful, bionic, cosmic, disco, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 14, needs-triage 3, ignored 2, DNE 1. | https://ubuntu.com/security/CVE-2018-1313 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | derby | >= 10.3.1.4, <= 10.14.1.0 | cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:* |
| oracle | weblogic_server | 12.2.1.3 | cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:* |