{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-30T12:13:02.066","vulnerabilities":[{"cve":{"id":"CVE-2021-23463","sourceIdentifier":"report@snyk.io","published":"2021-12-10T20:15:07.917","lastModified":"2026-06-17T03:38:47.610","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability."},{"lang":"es","value":"El paquete com.h2database:h2 a partir de la versión 1.4.198 y antes de la versión 2.0.202 son vulnerables a la Inyección de Entidades Externas XML (XXE) a través del objeto de clase org.h2.jdbc.JdbcSQLXML, cuando recibe datos de cadena analizados del método org.h2.jdbc.JdbcResultSet.getSQLXML(). Si ejecuta el método getSource() cuando el parámetro es DOMSource.class activará la vulnerabilidad"}],"affected":[{"source":"report@snyk.io","affectedData":[{"vendor":"n/a","product":"com.h2database:h2","versions":[{"version":"0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"unspecified","lessThan":"2.0.202","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"report@snyk.io","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-611"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.198","versionEndExcluding":"2.0.202","matchCriteriaId":"BF697BB1-B848-4C0B-8DFF-EA0DB4F46D13"}]}]}],"references":[{"url":"https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3","source":"report@snyk.io","tags":["Broken Link"]},{"url":"https://github.com/h2database/h2database/issues/3195","source":"report@snyk.io","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/h2database/h2database/pull/3199","source":"report@snyk.io","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0010/","source":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238","source":"report@snyk.io","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","source":"report@snyk.io","tags":["Not Applicable"]},{"url":"https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"https://github.com/h2database/h2database/issues/3195","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/h2database/h2database/pull/3199","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0010/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"]}]}}]}