CVE-2021-23463high

CVE-2021-23463: high-severity vulnerability in com.h2database:h2

XML External Entity (XXE) Injection

Published · Updated

Follow this CVE+ Monitor com.h2database:h2+ Monitor com.h2database:h2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 2.8%
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P
Affected products
n/a · com.h2database:h2