CVE-2021-23463: XML External Entity (XXE) Injection
Vulnerability summary
CVE-2021-23463 is a critical (CVSS 9.1) vulnerability in h2database h2. EPSS estimates a 2.79% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 10-12-2021PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:PDiffers
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
EPSS trend
Probability
2.79%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.79% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundH2Database
Maturity: poc
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Com.h2database1 product
- h2≥ 1.4.198, < 2.0.202
H2database1 product
- h2≥ 1.4.198, < 2.0.202
2 vendors · 2 products
