CVE-2022-23221
ADVISORY - githubSummary
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
Common Weakness Enumeration (CWE)
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
Improper Control of Generation of Code ('Code Injection')
Deserialization of Untrusted Data
NIST
3.9
CVSS SCORE
9.8criticalGitHub
3.9
CVSS SCORE
9.8criticalDebian
-
Ubuntu
3.9
CVSS SCORE
9.8mediumRed Hat
3.9
CVSS SCORE
9.8highintheWild
-
-