Vulnerability Description
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| H2Database | H2 | >= 1.4.198, < 2.0.202 |
Related Weaknesses (CWE)
References
- https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5Broken Link
- https://github.com/h2database/h2database/issues/3195ExploitIssue TrackingPatch
- https://github.com/h2database/h2database/pull/3199Issue TrackingPatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230818-0010/
- https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238ExploitPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable
- https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5Broken Link
- https://github.com/h2database/h2database/issues/3195ExploitIssue TrackingPatch
- https://github.com/h2database/h2database/pull/3199Issue TrackingPatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230818-0010/
- https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238ExploitPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable
FAQ
What is CVE-2021-23463?
CVE-2021-23463 is a vulnerability with a CVSS score of 8.1 (HIGH). The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data fro...
How severe is CVE-2021-23463?
CVE-2021-23463 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-23463?
Check the references section above for vendor advisories and patch information. Affected products include: H2Database H2.