CVE-2022-23221: debian debian_linux

Modified

AliasesUBUNTU-CVE-2022-23221DEBIAN-CVE-2022-23221GHSA-45hx-wfhj-473x

Published 19-01-2022Last modified 05-05-2025

Vulnerability summary

CVE-2022-23221 is a high (CVSS 10.0) vulnerability in debian debian_linux. EPSS estimates a 64.77% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

64.77%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 8 · Related 2

DLA-2923-1 DSA-5076-1 RHSA-2022:4918 RHSA-2022:4919 RHSA-2024:10207 RHSA-2024:10208+2 more

Timeline

19-01-2022
PublishedVulnerability first disclosed.
05-05-2025
Last modifiedVulnerability information updated.

Description

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.19.8v2.010.0

EPSS trend

Probability

64.77%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 64.77% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (twitter.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a CommandThe product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products

h2database< 2.1.210-1
debian_linuxEOL9.0 | 10.0 | 11.0

Com.h2database1 product

h2< 2.1.210

H2database1 product

h2≥ 1.1.100, < 2.0.206

Oracle1 product

communications_cloud_native_core_console1.9.0

Ubuntu1 product

h2database< 1.4.191-1ubuntu0.1~esm1 | < 1.4.196-2ubuntu0.1~esm1 | < 1.4.197-4+deb10u1build0.20.04.1 | < 2.1.210+really1.4.197-1

5 vendors · 6 products

References

18 links

github.com/h2database/h2database/security/advisoriesREPORTWEBMitigationPatchThird Party Advisory
seclists.org/fulldisclosure/2022/Jan/39Mailing ListWEBExploitThird Party Advisory
lists.debian.org/debian-lts-announce/2022/02/msg00017.htmlMailing ListWEBThird Party Advisory
www.debian.org/security/2022/dsa-5076Vendor AdvisoryWEBThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlWEBPatchThird Party Advisory
github.com/h2database/h2database/releases/tag/version-2.1.210REPORTWEBPatchRelease NotesThird Party Advisory
twitter.com/d0nkey_man/status/1483824727936450564REPORTWEBExploitThird Party Advisory
packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.htmlWEBExploitThird Party AdvisoryVDB Entry
www.oracle.com/security-alerts/cpujul2022.htmlWEBNot Applicable
security.netapp.com/advisory/ntap-20230818-0011/

Show all 18 references

ubuntu.com/security/CVE-2022-23221REPORT
ubuntu.com/security/notices/USN-5365-1Advisory
www.cve.org/CVERecord?id=CVE-2022-23221REPORT
ubuntu.com/security/notices/USN-6834-1Advisory
security-tracker.debian.org/tracker/CVE-2022-23221Advisory
nvd.nist.gov/vuln/detail/CVE-2022-23221Advisory
github.com/h2database/h2databasePACKAGE
security.netapp.com/advisory/ntap-20230818-0011WEB