CVE-2021-42392

Katalog CVE

CVSS 9.8 · Critical EPSS 83,2%

Kerentanan Deserialization of Untrusted Data pada h2database h2, debian linux +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Rincian

Terbit di NVD

10 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

83,2% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/ exploit · deskripsi teknis · advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6 mitigasi · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/02/msg00017.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220119-0001/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5076 advisory pihak ketiga
• https://www.secpod.com/blog/log4shell-critical-remote-code-execution-vulnerability-in-h2database-console/