TI-2022-22667 Aliases CVE-2022-45868 GHSA-22wj-vf5f-wrvj

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the…

HIGH 72CWE-312Published 2022-11-23 · Updated 2024-11-19

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312.

Summary

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00321 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed com.h2database:h2 (Maven): 2.2.220

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	com.h2database:h2 (Maven)	1.4.198 to before 2.2.220	2.2.220	Patch available	GHSA-22wj-vf5f-wrvj

— Vendor— Affected all versions Fixed in — No fix listed CNA
com.h2database:h2 (Maven) Vendor— Affected 1.4.198 to before 2.2.220 Fixed in 2.2.220 Patch available GHSA-22wj-vf5f-wrvj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:h2database:h2::::::::	up to 2.1.214	Vulnerable	h2database

cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:* Versions up to 2.1.214 Vulnerable ·h2database

Remediation

Fix · GHSA-22wj-vf5f-wrvj com.h2database:h2 (Maven) Fixed in 2.2.220 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-45868
2026-10-03 Alias added: GHSA-22wj-vf5f-wrvj

References

Exploit 1

https://sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243

Advisory 3

Other 5

TI-2022-07362 H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
TI-2021-18806 Deserialization of untrusted data in h2database h2 CVSS 3.1CRITICAL 9.8
TI-2018-07125 H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code… CVSS 3.1HIGH 8.8
TI-2018-10278 An issue was discovered in H2 1.4.197. CVSS 3.1MEDIUM 6.5
TI-2021-06145 XML external entity (XXE) injection in com.h2database:h2 CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences