CVE-2022-41853

Aliases:GHSA-77xx-rxvh-q682
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 06 Oct 2022, 17:14
Last modified:21 Apr 2025, 13:48

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
70.14% CRITICAL
70% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 Oct 2022, 17:14
Published
Vulnerability first disclosed
21 Apr 2025, 13:48
Last Modified
Vulnerability information updated

Description

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

CVSS Metrics

  • v3.1•HIGH•Score: 8CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 70.14%• Percentile: 99%

Techniques & Countermeasures

  • CWE-470•Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

    The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Affected Systems

  • debian•debian_linux

    10.0 | 11.0

  • hsqldb•hypersql_database

    < 2.7.1

  • hypersql database•hsqldb

    ≥ unspecified, < 2.7.1

  • org.hsqldb•hsqldb

    < 2.7.1

References (6)