{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-08T04:40:34.253","vulnerabilities":[{"cve":{"id":"CVE-2022-42467","sourceIdentifier":"security@apache.org","published":"2022-10-19T08:15:11.427","lastModified":"2024-11-21T07:25:01.303","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the 'isis.prototyping.h2-console.web-allow-remote-access' configuration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the new 'isis.prototyping.h2-console.generate-random-web-admin-password' configuration parameter (enabled by default) requires that the administrator use a randomly generated password to use the console. The password is printed to the log, as \"webAdminPass: xxx\" (where \"xxx\") is the password. To revert to the original behaviour, the administrator would therefore need to set these configuration parameter: isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false Note also that the h2 webconsole is never available in production mode, so these safeguards are only to ensure that the webconsole is secured by default also in prototype mode."},{"lang":"es","value":"Cuando es ejecutado en modo prototipo, el módulo h2 webconsole (accesible desde el menú Prototipo) es puesto automáticamente a disposición con la capacidad de consultar directamente la base de datos. Ha sido considerado que es más seguro exigir al desarrollador que habilite explícitamente esta capacidad. A partir de la versión 2.0.0-M8, esto puede hacerse usando la propiedad de configuración \"isis.prototyping.h2-console.web-allow-remote-access\"; la consola web no estará disponible si no es establecida esta configuración. Como protección adicional, el nuevo parámetro de configuración \"isis.prototyping.h2-console.generate-random-web-admin-password\" (habilitado por defecto) requiere que el administrador use una contraseña generada aleatoriamente para usar la consola. La contraseña es impresa en el registro, como \"webAdminPass: xxx\" (donde \"xxx\" es la contraseña. Para volver al comportamiento original, el administrador tendría que establecer estos parámetros de configuración: isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false Tenga en cuenta también que la consola web h2 nunca está disponible en modo de producción, por lo que estas salvaguardas son sólo para asegurar que la consola web está asegurada por defecto también en modo prototipo"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-1188"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0","matchCriteriaId":"E940F705-65AB-4319-99DB-67D73F62E2F2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:2.0.0:milestone1:*:*:*:*:*:*","matchCriteriaId":"E5D32A2B-ECBA-40E5-AF1D-194C536645EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:2.0.0:milestone2:*:*:*:*:*:*","matchCriteriaId":"B8389E1B-8771-4548-8B83-B39E15D01C4C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:2.0.0:milestone3:*:*:*:*:*:*","matchCriteriaId":"A2318214-EF00-4539-8D05-4F711EAD9DD5"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:2.0.0:milestone4:*:*:*:*:*:*","matchCriteriaId":"02F94190-2ADB-449A-A4E9-BE59942062CE"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:2.0.0:milestone5:*:*:*:*:*:*","matchCriteriaId":"B3CC7391-4AA4-411C-BC8A-AF9076669F11"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:2.0.0:milestone6:*:*:*:*:*:*","matchCriteriaId":"49C66C27-8D1F-468A-A1AD-B6537E6F5587"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:isis:2.0.0:milestone7:*:*:*:*:*:*","matchCriteriaId":"5F9C0F4C-618B-4CF0-BC5E-0A527FCE968E"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2022/10/19/1","source":"security@apache.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/jbv2ddt00h7ntlbm6vkk4wdmb31pm8q3","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/10/19/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/jbv2ddt00h7ntlbm6vkk4wdmb31pm8q3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]}]}}]}