VulnSocial

CVE-2021-42392Disclosure(debian / communications_cloud_native_core_policy)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

debian CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • communications_cloud_native_core_policy
  • debian_linux
  • h2

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
debianh2databaseoracle
Products
communications_cloud_native_core_policydebian_linuxh2

4 versions affected across 3 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-18: 1Technical Details · 2026-09-18: 109-18
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2021-42392 - critical 🚨 H2 Database Console - JNDI Injection RCE > The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters... 👾 https://cloud.projectdiscovery.io/library/CVE-2021-42392 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet discloses CVE-2021-42392, highlighting a critical JNDI Injection RCE in H2 Database Console with technical details, but does not mention exploits, patches, or active exploitation.

    140139762
    1.4K followersView on X
CPE platform detail5 entries

5 of 5 entries

PartVendorProductVersionTarget SWTarget HW
OSdebiandebian_linux10.0--
OSdebiandebian_linux11.0--
OSdebiandebian_linux9.0--
Apph2databaseh2---
Apporaclecommunications_cloud_native_core_policy1.15.0--

Explore more

Back to dashboarddebian CVEsh2database CVEsoracle CVEscommunications_cloud_native_core_policy vulnerabilities