H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| com.h2database:h2(Maven) | 0 | 2.1.210 | N/A |
CVSS Metrics
