Improper Restriction of XML External Entity Reference in com.h2database:h2.
High severity
GitHub Reviewed
Published
Dec 16, 2021
to the GitHub Advisory Database
•
Updated Aug 18, 2023
Description
Published by the National Vulnerability Database
Dec 10, 2021
Reviewed
Dec 14, 2021
Published to the GitHub Advisory Database
Dec 16, 2021
Last updated
Aug 18, 2023
Credits
-
mprins Analyst
H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
References