PT-2022-7166 · Unknown+1 · H2 Database Engine+1

Legolasbo + 3 · Published 2022-11-23 · Updated 2024-08-03 · CVE-2022-45868

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions H2 Database Engine versions prior to 2.2.220

Description The web-based admin console in H2 Database Engine can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. The issue was fixed in version 2.2.220.

Recommendations For H2 Database Engine versions prior to 2.2.220, update to version 2.2.220 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the -webAdminPassword argument when starting the web-based admin console via the CLI to minimize the risk of password exposure.

Exploit

Fix

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-312

Related Identifiers

BDU:2023-08539

CVE-2022-45868

GHSA-22WJ-VF5F-WRVJ

Affected Products

Debian

H2 Database Engine

References · 23

• 🔥 https://sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243 · Exploit
• https://osv.dev/vulnerability/GHSA-22wj-vf5f-wrvj · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45868 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08539 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-45868 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45868 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-45868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45868 · Security Note
• https://ubuntu.com/security/CVE-2022-45868 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45868 · Vendor Advisory
• https://github.com/h2database/h2database · Note
• https://github.com/h2database/h2database/releases/tag/version-2.2.220 · Note
• https://github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/WebServer.java#L346-L347 · Note
• https://github.com/h2database/h2database/pull/3833 · Note
• https://github.com/h2database/h2database/issues/3686 · Note