CVE-2021-23463

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

CVSS v3 9.1 CRITICAL
CVSS v2.0 6.4 MEDIUM

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3	Broken Link
https://github.com/h2database/h2database/issues/3195	Exploit Issue Tracking Patch Third Party Advisory
https://github.com/h2database/h2database/pull/3199	Issue Tracking Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20230818-0010/
https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238	Exploit Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-12-10 20:15

Updated : 2023-08-18 14:15

NVD link : CVE-2021-23463

Mitre link : CVE-2021-23463

CVE.ORG link : CVE-2021-23463

JSON object : View

Products Affected

h2database

h2

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2021-23463", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2021-12-10T20:15:07.917", "references": [{"url": "https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3", "tags": ["Broken Link"], "source": "report@snyk.io"}, {"url": "https://github.com/h2database/h2database/issues/3195", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/h2database/h2database/pull/3199", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://security.netapp.com/advisory/ntap-20230818-0010/", "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["Not Applicable"], "source": "report@snyk.io"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability."}, {"lang": "es", "value": "El paquete com.h2database:h2 a partir de la versi\u00f3n 1.4.198 y antes de la versi\u00f3n 2.0.202 son vulnerables a la Inyecci\u00f3n de Entidades Externas XML (XXE) a trav\u00e9s del objeto de clase org.h2.jdbc.JdbcSQLXML, cuando recibe datos de cadena analizados del m\u00e9todo org.h2.jdbc.JdbcResultSet.getSQLXML(). Si ejecuta el m\u00e9todo getSource() cuando el par\u00e1metro es DOMSource.class activar\u00e1 la vulnerabilidad"}], "lastModified": "2023-08-18T14:15:19.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF697BB1-B848-4C0B-8DFF-EA0DB4F46D13", "versionEndExcluding": "2.0.202", "versionStartIncluding": "1.4.198"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}