CVE-2021-23463 — XML External Entity (XXE) Injection in H2

CWE-611 — XML External Entity (XXE) Injection5 documents5 sources
Severity
9.1CRITICALNVD
EPSS
0.8%
top 26.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
H2database H2Debian H2database
Timeline
PublishedDec 10
Latest updateDec 16

Description

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶NVDh2database/h21.4.198 — 2.0.202

Patches

Patch: github.com ↗Patch: github.com ↗Patch: snyk.io ↗

🔴Vulnerability Details

2
OSV
Improper Restriction of XML External Entity Reference in com.h2database:h2.↗2021-12-16
▶
GHSA
Improper Restriction of XML External Entity Reference in com.h2database:h2.↗2021-12-16
▶

📋Vendor Advisories

2
Red Hat
h2database: XXE injection vulnerability↗2021-10-22
▶
Debian
CVE-2021-23463: h2database - The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to ...↗2021
▶
CVE-2021-23463 — XML External Entity (XXE) Injection | cvebase