Login Request a demo
Critical severity · published Dec 10, 2021
CVE-2021-23463
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives…
9.1
CVSS
2.8%
EPSS
No
On KEV
Description
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
H2 · H2database
1.4.198 before 2.0.202 · source: NVD
Affected product
H2
H2
H2database
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23463
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23463
Broken Link
https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3
Exploit
https://github.com/h2database/h2database/issues/3195
Issue Tracking
https://github.com/h2database/h2database/pull/3199
security.netapp.com
https://security.netapp.com/advisory/ntap-20230818-0010/
Exploit
https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238
Not Applicable
https://www.oracle.com/security-alerts/cpuapr2022.html
More from H2
9.8
CVE-2022-23221
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the…
9.8
CVE-2021-42392
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database
8.8
CVE-2018-10054
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code
7.8
CVE-2022-45868
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in…
6.5
CVE-2018-14335
An issue was discovered in H2 1.4.197