Arbitrary code execution in H2 Console

CRITICAL 9.8CVE-2022-23221 · GHSA-45hx-wfhj-473x · Published 19/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
com.h2database:h2 Maven	`< 2.1.210`	`2.1.210`
h2 h2database	`≥ 1.1.100, < 2.0.206`	`2.0.206`
communications cloud native core console oracle	`= 1.9.0`	No fix yet

Description

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23221 · ADVISORY
h2database/h2database · PACKAGE
h2database/h2database release version-2.1.210 · WEB
h2database/h2database security advisory · WEB
lists.debian.org/debian-lts-announce/2022/02/msg00017.html · WEB
security.netapp.com/advisory/ntap-20230818-0011 · WEB
twitter.com/d0nkey_man/status/1483824727936450564 · WEB
debian.org/security/2022/dsa-5076 · WEB
oracle.com/security-alerts/cpuapr2022.html · WEB
oracle.com/security-alerts/cpujul2022.html · WEB
packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html · WEB
seclists.org/fulldisclosure/2022/Jan/39 · WEB
security.netapp.com/advisory/ntap-20230818-0011

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free