Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2009-4269

12
FAUCET Score

CVE-2009-4269 describes a weakness in the password hash generation within Apache Derby's BUILTIN authentication, affecting versions prior to 10.6.1.0. The vulnerability stems from a transformation that reduces the input space for SHA-1, making it easier for local attackers to crack passwords through hash collisions. With a CVSS score of 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N), it indicates low severity, requiring local access for a partial confidentiality impact. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 10.5.3.0CPE matchmatch criteria
cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

2.1LOW

AV:L/AC:L/Au:N/C:P/I:N/A:N

Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Exploitability Score
3.9
Impact Score
2.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
1.43%
Probability of exploitation in next 30 days
EPSS Percentile
70.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0143 is in the 94th percentile among its peer group of 2,096 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.6 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

mavenpatch availablevia ghsa
Product: org.apache.derby:derbyFixed in: 10.6.1.0

Vendor Advisories (1)

mavenGHSA-fh32-35w2-rxccmedium

Use of Password Hash With Insufficient Computational Effort in Apache Derby

May 2, 2022

References

blogs.sun.com / kah/entry/derby_10_6_1_has
db.apache.org / derby/releases/release-10.6.1.0.cgi
marcellmajor.com / derbyhash.html
marc.info
secunia.com / advisories/42948
secunia.com / advisories/42970
issues.apache.org / jira/browse/DERBY-4483
Vendor Advisory
oracle.com / technetwork/topics/security/cpujan2011-194091.html
securityfocus.com / bid/42637
securitytracker.com / id
vupen.com / english/advisories/2011/0149