GitHub Advisoryadvisory · Maven

GHSA-7rpj-hg47-cx62 Improper Restriction of XML External Entity Reference in com.h2database:h2.

HIGH Published 2021-12-16 Modified 2023-03-21 Official page ↗
Aliases
CVE-2021-23463
Ecosystem
Maven
Packages
com.h2database:h2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-611
Reviewed
2021-12-14

Affected packages

• Maven com.h2database:h2: >= 1.4.198, < 2.0.202 → fixed in 2.0.202

Description

H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-23463 The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References