You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVE-2021-23463 - High Severity Vulnerability
Vulnerable Library - h2-1.4.200.jar
H2 Database Engine
Library home page: https://h2database.com
Path to dependency file: /integ-test/build.gradle
Path to vulnerable library: /er/.gradle/caches/modules-2/files-2.1/com.h2database/h2/1.4.200/f7533fe7cb8e99c87a43d325a77b4b678ad9031a/h2-1.4.200.jar
Dependency Hierarchy:
Found in HEAD commit: 1a2bfe2a9f9a3c0a91ff373481b34ed1b816283c
Found in base branch: main
Vulnerability Details
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
Publish Date: 2021-12-10
URL: CVE-2021-23463
CVSS 3 Score Details (9.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23463
Release Date: 2021-12-10
Fix Resolution: com.h2database:h2:2.0.202
The text was updated successfully, but these errors were encountered: