How severe is CVE-2009-4269?

CVE-2009-4269 has a CVSS 2.0 base score of 2.1, rated low severity.

Is CVE-2009-4269 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-4269?

CVE-2009-4269 affects Apache Derby. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2009-4269?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2009-4269 published?

CVE-2009-4269 was published on 2010-08-16 and last updated on 2026-06-16.

CVE-2009-4269

CVE-2009-4269 is a low-severity vulnerability in Apache Derby with a CVSS 2.0 base score of 2.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-310.

Key facts

Severity: Low (CVSS 2.0 base score 2.1)
EPSS exploit prediction: 1% (70th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-310
Affected product: Apache Derby
Published: 2010-08-16
Last modified: 2026-06-16

Description

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

Frequently asked questions

What is CVE-2009-4269?: The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
How severe is CVE-2009-4269?: CVE-2009-4269 has a CVSS 2.0 base score of 2.1, rated low severity.
Is CVE-2009-4269 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2009-4269?: CVE-2009-4269 affects Apache Derby. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2009-4269?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2009-4269 published?: CVE-2009-4269 was published on 2010-08-16 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Derby

CVE-2022-46337 — Critical (CVSS 9.8): A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this…
CVE-2015-1832 — Critical (CVSS 9.1): XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security…
CVE-2010-2232 — High (CVSS 7.5): In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an…
CVE-2018-1313 — Medium (CVSS 5.3): In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network…
CVE-2005-4849 — Medium (CVSS 5.0): Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter…
CVE-2006-7216 — Medium (CVSS 4.0): Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time,…

All CVEs affecting Apache Derby →

Other CWE-310 (Cryptographic Issues) vulnerabilities

CVE-2014-7878 — Critical (CVSS 10.0): The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived…
CVE-2013-3712 — Critical (CVSS 10.0): SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has…
CVE-2013-6952 — Critical (CVSS 10.0): The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote…
CVE-2013-6838 — Critical (CVSS 10.0): An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000)…
CVE-2013-0137 — Critical (CVSS 10.0): The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189…
CVE-2011-5123 — Critical (CVSS 10.0): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in…

Browse all CWE-310 (Cryptographic Issues) vulnerabilities →