CVE-2022-23221

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Jan/39Exploit, Mailing List, Third Party Advisory
https://github.com/h2database/h2database/releases/tag/version-2.1.210Patch, Release Notes, Third Party Advisory
https://github.com/h2database/h2database/security/advisoriesMitigation, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00017.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230818-0011/
https://twitter.com/d0nkey_man/status/1483824727936450564Exploit, Third Party Advisory
https://www.debian.org/security/2022/dsa-5076Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable
http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Jan/39Exploit, Mailing List, Third Party Advisory
https://github.com/h2database/h2database/releases/tag/version-2.1.210Patch, Release Notes, Third Party Advisory
https://github.com/h2database/h2database/security/advisoriesMitigation, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00017.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230818-0011/
https://twitter.com/d0nkey_man/status/1483824727936450564Exploit, Third Party Advisory
https://www.debian.org/security/2022/dsa-5076Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable

Timeline

Published: Jan 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-232227.8kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arith CVE-2022-232237.5On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade CVE-2022-232279.8NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users CVE-2022-232287.5Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily CVE-2022-23238.8Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in CVE-2022-232324.9StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited co CVE-2022-232337.5StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited co CVE-2022-232345.5SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext H CVE-2022-232355.3Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to a vulnerability which CVE-2022-232364.4E-Series SANtricity OS Controller Software versions 11.40 through 11.70.2 store the LDAP BIND password in plaintext within a file accessible CVE-2022-232376.1E-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host header injection attacks that could allow an CVE-2022-232386.5Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less