Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 3 products
🚨 CVE-2021-42392 - critical 🚨 H2 Database Console - JNDI Injection RCE > The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters... 👾 https://cloud.projectdiscovery.io/library/CVE-2021-42392 @pdnuclei #NucleiTemplates #cve
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 10.0 | - | - |
| OS | debian | debian_linux | 11.0 | - | - |
| OS | debian | debian_linux | 9.0 | - | - |
| App | h2database | h2 | - | - | - |
| App | oracle | communications_cloud_native_core_policy | 1.15.0 | - | - |