CVE-2022-45868
HIGH 8.4
At a glance
- Source
- NVD
- EPSS
- EPSS 0.31 % · percentile 24 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
Weaknesses (CWE)
- CWE-312 — Cleartext Storage of Sensitive Information
References
- https://sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243
- https://github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/WebServer.java#L346-L347
- https://github.com/h2database/h2database/issues/3686
- https://github.com/advisories/GHSA-22wj-vf5f-wrvj
- https://github.com/h2database/h2database/pull/3833
- https://github.com/h2database/h2database/releases/tag/version-2.2.220
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N | mitre |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · cve@mitre.org (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-22wj-vf5f-wrvj — Password exposure in H2 Database
European references
- ENISA EUVD · EUVD-2022-7189
- GCVE · GCVE-0-2022-45868
CERT-FR advisories
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:*≤ 2.1.214
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |