Vulnerabilities > CVE-2021-42392 - Deserialization of Untrusted Data vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

critical

NVD

Published: 2022-01-10

Updated: 2023-02-24

Summary

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Vulnerable Configurations

Part	Description	Count
Application	H2Database H2Database H2 1.1.101 H2Database H2 1.1.102 H2Database H2 1.1.103 H2Database H2 1.1.104 H2Database H2 1.1.105 H2Database H2 1.1.106 H2Database H2 1.1.107 H2Database H2 1.1.108 H2Database H2 1.1.109 H2Database H2 1.1.110 H2Database H2 1.1.111 H2Database H2 1.1.112 H2Database H2 1.1.113 H2Database H2 1.1.114 H2Database H2 1.1.115 H2Database H2 1.1.116 H2Database H2 1.1.117 H2Database H2 1.1.118 H2Database H2 1.1.119 H2Database H2 1.2.120 H2Database H2 1.2.121 H2Database H2 1.2.122 H2Database H2 1.2.123 H2Database H2 1.2.124 H2Database H2 1.2.125 H2Database H2 1.2.126 H2Database H2 1.2.127 H2Database H2 1.2.128 H2Database H2 1.2.129 H2Database H2 1.2.130 H2Database H2 1.2.131 H2Database H2 1.2.132 H2Database H2 1.2.133 H2Database H2 1.2.134 H2Database H2 1.2.135 H2Database H2 1.2.136 H2Database H2 1.2.137 H2Database H2 1.2.138 H2Database H2 1.2.139 H2Database H2 1.2.140 H2Database H2 1.2.141 H2Database H2 1.2.142 H2Database H2 1.2.143 H2Database H2 1.2.144 H2Database H2 1.2.145 H2Database H2 1.2.147 H2Database H2 1.3.146 H2Database H2 1.3.148 H2Database H2 1.3.149 H2Database H2 1.3.150 H2Database H2 1.3.151 H2Database H2 1.3.152 H2Database H2 1.3.153 H2Database H2 1.3.154 H2Database H2 1.3.155 H2Database H2 1.3.156 H2Database H2 1.3.157 H2Database H2 1.3.158 H2Database H2 1.3.159 H2Database H2 1.3.160 H2Database H2 1.3.161 H2Database H2 1.3.162 H2Database H2 1.3.163 H2Database H2 1.3.164 H2Database H2 1.3.165 H2Database H2 1.3.166 H2Database H2 1.3.167 H2Database H2 1.3.168 H2Database H2 1.3.169 H2Database H2 1.3.170 H2Database H2 1.3.171 H2Database H2 1.3.172 H2Database H2 1.3.173 H2Database H2 1.3.174 H2Database H2 1.3.175 H2Database H2 1.4.177 H2Database H2 1.4.178 H2Database H2 1.4.181 H2Database H2 1.4.182 H2Database H2 1.4.183 H2Database H2 1.4.184 H2Database H2 1.4.185 H2Database H2 1.4.186 H2Database H2 1.4.187 H2Database H2 1.4.188 H2Database H2 1.4.190 H2Database H2 1.4.191 H2Database H2 1.4.192 H2Database H2 1.4.193 H2Database H2 1.4.194 H2Database H2 1.4.195 H2Database H2 1.4.196 H2Database H2 1.4.197 H2Database H2 1.4.198 H2Database H2 1.4.199 H2Database H2 1.4.200 H2Database H2 2.0.202 H2Database H2 2.0.204	104
Application	Oracle Oracle Communications Cloud Native Core Policy 1.15.0	1
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0	3

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Vulnerabilities > CVE-2021-42392 - Deserialization of Untrusted Data vulnerability in multiple products

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Related news

References