CVE-2021-23463 XML External Entity (XXE) Injection

2021-12-1020:00:14

snyk

www.cve.org

cve-2021-23463

xml external entity (xxe) injection

com.h2database:h2

org.h2.jdbc.jdbcsqlxml

domsource class

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P

AI Score

9.6

Confidence

High

EPSS

0.01

Percentile

84.2%

JSON

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "com.h2database:h2",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2.0.202",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3

github.com/h2database/h2database/issues/3195

github.com/h2database/h2database/pull/3199

security.netapp.com/advisory/ntap-20230818-0010/

snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238

www.oracle.com/security-alerts/cpuapr2022.html