CVE-2009-4269

low Apache
CVSS v3 Base Score
2.1
AV:L/AC:L/Au:N/C:P/I:N/A:N
EPSS Score
0.8%
Exploitation probability in 30 days
Top 26% most likely to be exploited
Attack Characteristics
Attack Vector
Local
Attack Complexity
Low
Confidentiality
P
Integrity
None
Availability
None
Published: August 16, 2010 (5750 days ago)
Last Modified: April 29, 2026
Vendor: Apache
Source: NVD

Description

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

CWE

CWE-310

Affected Products

apache derby

References

🔗 blogs.sun.com 🔗 db.apache.org 🔗 marc.info 🔗 marcellmajor.com 🔗 secunia.com