Описание
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needs-triage |
| devel | not-affected | 2.1.210 |
| esm-apps/bionic | released | 1.4.196-2ubuntu0.1~esm1 |
| esm-apps/focal | released | 1.4.197-4+deb10u1build0.20.04.1 |
| esm-apps/jammy | released | 2.1.210+really1.4.197-1 |
| esm-apps/noble | not-affected | 2.1.210 |
| esm-apps/xenial | released | 1.4.191-1ubuntu0.1~esm1 |
| focal | released | 1.4.197-4+deb10u1build0.20.04.1 |
| hirsute | ignored | end of life |
| impish | released | 1.4.197-4+deb10u1build0.21.10.1 |
Показывать по
Ссылки на источники
EPSS
10 Critical
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
H2 Console before 2.1.210 allows remote attackers to execute arbitrary ...
Уязвимость системы управления базами данных H2 , связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код
EPSS
10 Critical
CVSS2
9.8 Critical
CVSS3