Password exposure in H2 Database

高 7.8CVE-2022-45868 · GHSA-22wj-vf5f-wrvj · 23/11/2022 公開 · 17/06/2026 更新

要点

CVE-2022-45868 は com.h2database:h2, h2 (h2database) に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 25.1% より高い）。
対処：2.2.220 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.h2database:h2 Maven	`≥ 1.4.198, < 2.2.220`	`2.2.220`
h2 h2database	`≤ 2.1.214`	修正版なし

概要

The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that."

NVD の説明

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.