{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-23463", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "dateUpdated": "2024-09-17T03:47:43.105Z", "dateReserved": "2021-01-08T00:00:00", "datePublished": "2021-12-10T20:00:14.594368Z"}, "containers": {"cna": {"title": "XML External Entity (XXE) Injection", "datePublic": "2021-12-10T00:00:00", "providerMetadata": {"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2023-08-18T13:06:24.563141"}, "descriptions": [{"lang": "en", "value": "The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability."}], "affected": [{"vendor": "n/a", "product": "com.h2database:h2", "versions": [{"version": "0", "status": "affected", "lessThan": "unspecified", "versionType": "custom"}, {"version": "unspecified", "lessThan": "2.0.202", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://github.com/h2database/h2database/issues/3195"}, {"url": "https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238"}, {"url": "https://github.com/h2database/h2database/pull/3199"}, {"url": "https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}, {"url": "https://security.netapp.com/advisory/ntap-20230818-0010/"}], "credits": [{"lang": "en", "value": "threedr3am of SecCoder Security Lab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "exploitCodeMaturity": "PROOF_OF_CONCEPT", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "baseScore": 8.1, "temporalScore": 7.7, "baseSeverity": "HIGH", "temporalSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "XML External Entity (XXE) Injection"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:14:08.576Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/h2database/h2database/issues/3195", "tags": ["x_transferred"]}, {"url": "https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238", "tags": ["x_transferred"]}, {"url": "https://github.com/h2database/h2database/pull/3199", "tags": ["x_transferred"]}, {"url": "https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3", "tags": ["x_transferred"]}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230818-0010/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF697BB1-B848-4C0B-8DFF-EA0DB4F46D13", "versionEndExcluding": "2.0.202", "versionStartIncluding": "1.4.198", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability."}, {"lang": "es", "value": "El paquete com.h2database:h2 a partir de la versi\u00f3n 1.4.198 y antes de la versi\u00f3n 2.0.202 son vulnerables a la Inyecci\u00f3n de Entidades Externas XML (XXE) a trav\u00e9s del objeto de clase org.h2.jdbc.JdbcSQLXML, cuando recibe datos de cadena analizados del m\u00e9todo org.h2.jdbc.JdbcResultSet.getSQLXML(). Si ejecuta el m\u00e9todo getSource() cuando el par\u00e1metro es DOMSource.class activar\u00e1 la vulnerabilidad"}], "id": "CVE-2021-23463", "lastModified": "2023-08-18T14:15:19.227", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2021-12-10T20:15:07.917", "references": [{"source": "report@snyk.io", "tags": ["Broken Link"], "url": "https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/h2database/h2database/issues/3195"}, {"source": "report@snyk.io", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/h2database/h2database/pull/3199"}, {"source": "report@snyk.io", "url": "https://security.netapp.com/advisory/ntap-20230818-0010/"}, {"source": "report@snyk.io", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238"}, {"source": "report@snyk.io", "tags": ["Not Applicable"], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "h2database: XXE injection vulnerability", "id": "2033392", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2033392"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-611", "details": ["The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.", "A flaw was found in the h2database. This flaw allows an attacker to benefit from XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object. A user may trigger the vulnerability by sending malicious data."], "name": "CVE-2021-23463", "package_state": [{"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Affected", "impact": "low", "package_name": "com.h2database.h2", "product_name": "Red Hat build of Apicurio Registry"}, {"cpe": "cpe:/a:redhat:quarkus:2", "fix_state": "Affected", "package_name": "com.h2database.h2", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Out of support scope", "package_name": "com.h2database.h2", "product_name": "Red Hat Integration Service Registry"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "com.h2database.h2", "product_name": "Red Hat JBoss Fuse 7"}], "public_date": "2021-10-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-23463\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-23463"], "threat_severity": "Important"}