CVE-2021-23463

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	com.h2database:h2	< unspecified; >= unspecified, < 2.0.202

References

https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3Broken Link
https://github.com/h2database/h2database/issues/3195Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/h2database/h2database/pull/3199Issue Tracking, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230818-0010/
https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238Exploit, Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable
https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3Broken Link
https://github.com/h2database/h2database/issues/3195Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/h2database/h2database/pull/3199Issue Tracking, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230818-0010/
https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238Exploit, Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlNot Applicable

Timeline

Published: Dec 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23475.2Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version CVE-2021-234709.8This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can CVE-2021-234726.1This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization wh CVE-2021-23484.3Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Fra CVE-2021-234849.8The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction CVE-2021-23498.6Vulnerability in the Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Console). Supported versions that ar CVE-2021-234907.5The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.CVE-2021-234956.1The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.CVE-2021-234979.8This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execu CVE-2021-23507.5Vulnerability in the Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Console). Supported versions that ar CVE-2021-235079.8The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge obj CVE-2021-235099.8This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided