Critical severity9.8NVD Advisory· Published Jan 10, 2022· Updated Jun 17, 2026
CVE-2021-42392
CVE-2021-42392
Description
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.h2database:h2Maven | >= 1.1.100, < 2.0.206 | 2.0.206 |
Affected products
2- Range: 1.1.000
Patches
Vulnerability mechanics
References
13- www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
- jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/nvdExploitTechnical DescriptionVendor Advisory
- github.com/advisories/GHSA-h376-j262-vhq6ghsaADVISORY
- github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6nvdMitigationThird Party AdvisoryWEB
- lists.debian.org/debian-lts-announce/2022/02/msg00017.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-42392ghsaADVISORY
- security.netapp.com/advisory/ntap-20220119-0001/nvdThird Party Advisory
- www.debian.org/security/2022/dsa-5076nvdThird Party AdvisoryWEB
- github.com/h2database/h2database/releases/tag/version-2.0.206ghsaWEB
- jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-consoleghsaWEB
- security.netapp.com/advisory/ntap-20220119-0001ghsaWEB
- www.secpod.com/blog/log4shell-critical-remote-code-execution-vulnerability-in-h2database-consoleghsaWEB
- www.secpod.com/blog/log4shell-critical-remote-code-execution-vulnerability-in-h2database-console/nvd
News mentions
0No linked articles in our index yet.