Insecure Permissions Affecting com.h2database:h2 package, versions [1.1.100,1.4.198)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-COMH2DATABASE-3009896
- published 8 Sep 2022
- disclosed 26 Aug 2022
- credit piuppi
Introduced: 26 Aug 2022
CVE-2018-14335 Open this link in a new tabHow to fix?
Upgrade com.h2database:h2 to version 1.4.198 or higher.
Overview
com.h2database:h2 is a database engine
Affected versions of this package are vulnerable to Insecure Permissions in the backup function which allows attackers to read sensitive files (out of their permissions scope) via a symlink to a fake database file.
Note: This is exploitable only if users misconfigured applications with excessive permissions. The documentation of H2 contains all necessary warnings for insecure configuration options and suggests security constraints for H2 Console servlet.
According to the above, this is a low severity vulnerability because of the low likelihood of it being exploited.