Lucene search

SnykCVE-2021-23463

HistoryDec 10, 2021 - 8:15 p.m.

CVE-2021-23463

2021-12-1020:15:07

CWE-611

snyk

web.nvd.nist.gov

cve-2021-23463

nvd

package vulnerability

xxe injection

xml external entity

security issue

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.2

Confidence

High

EPSS

0.01

Percentile

84.2%

JSON

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

Affected configurations

Nvd

Node

h2databaseh2Range1.4.198–2.0.202

VendorProductVersionCPE
h2databaseh2*cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
h2database	h2	*	cpe:2.3:a:h2database:h2::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "com.h2database:h2",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2.0.202",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3

github.com/h2database/h2database/issues/3195

github.com/h2database/h2database/pull/3199

security.netapp.com/advisory/ntap-20230818-0010/

snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238

www.oracle.com/security-alerts/cpuapr2022.html