CVE-2021-23463
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.70%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- EPSS
- 2.70% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- h2database/h2
- Source
- report@snyk.io
References
- https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3Broken Link
- https://github.com/h2database/h2database/issues/3195Exploit, Issue Tracking, Patch, Third Party Advisory
- https://github.com/h2database/h2database/pull/3199Issue Tracking, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230818-0010/
- https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238Exploit, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable
- https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3Broken Link
- https://github.com/h2database/h2database/issues/3195Exploit, Issue Tracking, Patch, Third Party Advisory
- https://github.com/h2database/h2database/pull/3199Issue Tracking, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230818-0010/
- https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238Exploit, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.