CVE-2021-23463

    Dashboard / Vulnerabilities / CVE-2021-23463

    CVE-2021-23463

    Published: 10 Dec 2021Last Modified: 9 Jul 2026

    Summary:

    Details: The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

    References: https://www.oracle.com/security-alerts/cpuapr2022.html, https://security.netapp.com/advisory/ntap-20230818-0010/, https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3, https://github.com/h2database/h2database/issues/3195, https://github.com/h2database/h2database/pull/3199, https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2b8fa36798a2f142d3b8eacf89b7da00645a6f75
    Fixed -bb50243925f1707495d0b8e06a3e0e6caeed17ed

    Affected versions

    version-1.4.200
    version-1.4.199
    version-1.4.198

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-23463 | CVE-DB