← Back to browse · API

CVE-2022-23221

Severity
CRITICAL
CVSS
9.8
EPSS
0.64766
Risk score
61.87
CISA KEV
No
PoC
No
Published
2022-01-19
Modified
2025-05-05
First seen
2026-08-07
Aliases
EUVD-2022-0440, GHSA-45HX-WFHJ-473X
Products
n/a:n/a n/a
Sources
euvd EUVD-2022-0440

Description

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

References