CVE-2018-14335

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-59 CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
h2database	h2	1.4.197

References

https://access.redhat.com/errata/RHSA-2020:0727
https://gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20Exploit, Third Party Advisory
https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E
https://security.netapp.com/advisory/ntap-20240726-0003/
https://www.exploit-db.com/exploits/45105/Exploit, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2020:0727
https://gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20Exploit, Third Party Advisory
https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E
https://security.netapp.com/advisory/ntap-20240726-0003/
https://www.exploit-db.com/exploits/45105/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jul 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-143367.5TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addre CVE-2018-143377.5The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds CVE-2018-143388.1samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where gli CVE-2018-143397.5In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in e CVE-2018-14348.8IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,CVE-2018-143407.5In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed CVE-2018-143417.5In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addre CVE-2018-143427.5In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed CVE-2018-143437.5In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors CVE-2018-143447.5In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ISMP dissector could crash. This was addressed in epan/dissectors/pack CVE-2018-143457.5An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already CVE-2018-143468.8GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).