Medium severity · published Jul 24, 2018
CVE-2018-14335
An issue was discovered in H2 1.4.197
6.5
CVSS
13.2%
EPSS
No
On KEV
Description
An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
H2 · H2database
1.4.197 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14335
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14335
access.redhat.com
https://access.redhat.com/errata/RHSA-2020:0727
Exploit
https://gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20
lists.apache.org
https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E
security.netapp.com
https://security.netapp.com/advisory/ntap-20240726-0003/
Exploit
https://www.exploit-db.com/exploits/45105/
More from H2
9.8
CVE-2022-23221
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the…
9.8
CVE-2021-42392
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database
9.1
CVE-2021-23463
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives…
8.8
CVE-2018-10054
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code
7.8
CVE-2022-45868
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in…