CVE-2022-23221criticalCWE-88

CVE-2022-23221

Published · Updated

Follow this CVE+ Monitor com.h2database:h2+ Monitor h2database

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

60Vexday Risk Score

Keep watching. It has a public proof of concept.

ssvc Attendcvss 9.8epss 65%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
13 products (14 components)
Red Hat OpenShift Container Platform 3.11 · Red Hat BPM Suite 6 · Red Hat JBoss BRMS 5 · Red Hat JBoss BRMS 6 · Red Hat JBoss Data Grid 7 · and others 8
no_fix_planned: Out of support scope
Fixed
6 products (67 components)
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · Red Hat JBoss EAP 7.4 for RHEL 7 Server · Red Hat JBoss EAP 7.4 for RHEL 8 · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · Red Hat Fuse 7.11 · and others 1
fix ↗
Not affected
9 products (2,368 components) — because the vulnerable code is not present in the product
Red Hat JBoss Enterprise Application Platform · Red Hat JBoss EAP 7.4 for RHEL 7 Server · Red Hat JBoss EAP 7.4 for RHEL 8 · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · Red Hat Decision Manager 7 · and others 4
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.