{"api_version":"1","generated_at":"2026-07-23T11:32:45+00:00","cve":"CVE-2009-4333","urls":{"html":"https://cve.report/CVE-2009-4333","api":"https://cve.report/api/cve/CVE-2009-4333.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-4333","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-4333"},"summary":{"title":"CVE-2009-4333","description":"The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-12-16 18:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21412902","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21412902","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"http://www.vupen.com/english/advisories/2009/3520","name":"http://www.vupen.com/english/advisories/2009/3520","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/37759","name":"http://secunia.com/advisories/37759","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM DB2 Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT","name":"ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"404"},{"url":"http://www.securityfocus.com/bid/37332","name":"http://www.securityfocus.com/bid/37332","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM DB2 prior to 9.5 Fix Pack 5 Multiple Unspecified Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21293566","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21293566","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"IBM Fix List for DB2 Version 9.5 for Linux, UNIX and Windows - United States","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ38819","name":"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ38819","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM IZ38819: SECURITY: VISIBILITY OF PASSWORDS IN SET ENCRYPTION PASSWORD    STATEMENT","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-4333","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4333","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"4333","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"4333","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"fp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"4333","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"fp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"4333","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"fp2a","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"4333","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"fp3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"4333","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"fp3a","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"4333","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.5","cpe7":"fp3b","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:01:19.966Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21293566"},{"name":"ADV-2009-3520","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/3520"},{"name":"37332","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/37332"},{"name":"IZ38819","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ38819"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21412902"},{"name":"37759","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/37759"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2009-12-16T18:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21293566"},{"name":"ADV-2009-3520","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/3520"},{"name":"37332","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/37332"},{"name":"IZ38819","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ38819"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21412902"},{"name":"37759","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/37759"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-4333","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT","refsource":"CONFIRM","url":"ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21293566","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21293566"},{"name":"ADV-2009-3520","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/3520"},{"name":"37332","refsource":"BID","url":"http://www.securityfocus.com/bid/37332"},{"name":"IZ38819","refsource":"AIXAPAR","url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ38819"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21412902","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21412902"},{"name":"37759","refsource":"SECUNIA","url":"http://secunia.com/advisories/37759"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-4333","datePublished":"2009-12-16T18:00:00.000Z","dateReserved":"2009-12-16T00:00:00.000Z","dateUpdated":"2024-09-17T04:24:00.480Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-12-16 18:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:*:*:*:*:*:*:*","matchCriteriaId":"11ABF7CC-2FA5-4F2D-901A-2D0EF5B8E717"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:fp1:*:*:*:*:*:*","matchCriteriaId":"58147402-53D5-4F15-862B-EE3DCCD75E2C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:fp2:*:*:*:*:*:*","matchCriteriaId":"D3F3CB5E-D4FB-4C03-B108-06CC358B1F45"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:fp2a:*:*:*:*:*:*","matchCriteriaId":"CB2EA14A-878A-4D8D-B17A-568712D21C48"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:fp3:*:*:*:*:*:*","matchCriteriaId":"84C925CD-E753-401F-9EC0-6E3D9861C818"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:fp3a:*:*:*:*:*:*","matchCriteriaId":"651D042C-A9F1-42D1-A6DD-95ADBCD08448"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2:9.5:fp3b:*:*:*:*:*:*","matchCriteriaId":"0A589323-B8B8-4CB4-B1A9-B9E771C99123"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"4333","Ordinal":"1","Title":"CVE-2009-4333","CVE":"CVE-2009-4333","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"4333","Ordinal":"1","NoteData":"The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command.","Type":"Description","Title":"CVE-2009-4333"},{"CveYear":"2009","CveId":"4333","Ordinal":"2","NoteData":"2009-12-16","Type":"Other","Title":"Published"}]}}}