Security readout for executives and security teams
Plain-English summary
H2 1.4.197 has a backup-function permission flaw that can let a low-privileged attacker read sensitive files through a symlinked fake database file. The main business risk is confidential data exposure, not system takeover or outage, based on the provided CVSS vector.
Executive priority
Treat as a targeted confidentiality risk. Prioritize systems storing sensitive data where H2 1.4.197 is present and backup functions are reachable by non-admin users. This is not evidenced as actively exploited in the supplied sources.
Technical view
The CVE describes insecure permission handling in H2 1.4.197 backup processing. A user with privileges to trigger the vulnerable path may cause file reads outside intended permissions through symlink behavior. CVSS 3.1 rates it 6.5 with high confidentiality impact and no integrity or availability impact.
Likely exposure
Exposure is most likely where H2 1.4.197 is embedded directly or bundled inside downstream products. The source bundle lists downstream references from Apache Ignite, Red Hat, and NetApp, but does not provide a complete affected product inventory.
Exploitation context
Public exploit references exist, including Exploit-DB and a GitHub gist. The bundle does not show CISA KEV listing or confirmed active exploitation. The CVSS vector indicates network reachability, low privileges, and no user interaction, but not unauthenticated exploitation.
Researcher notes
The affected field in the bundle is sparse, so validation should focus on dependency discovery and downstream advisories. Avoid assuming all H2 deployments are exploitable; the vulnerable backup path, privilege model, and product packaging determine practical exposure.
Mitigation direction
- Inventory applications and products that include H2 1.4.197.
- Check upstream and downstream vendor guidance for fixed versions or product-specific remediation.
- Apply relevant Red Hat, NetApp, or other vendor updates where applicable.
- Restrict access to H2 backup functionality to trusted administrators only.
- Review filesystem permissions and symlink handling around database backup locations.
Validation and detection
- Confirm whether H2 1.4.197 appears in dependency manifests, SBOMs, or packaged components.
- Identify any reachable H2 backup capability exposed to low-privileged users.
- Review vendor advisories for product-specific affected versions and fixed packages.
- Check whether sensitive filesystem paths are accessible from H2 runtime contexts.
- Look for suspicious backup activity involving unexpected database paths or symlinks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-14335 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- 45105CVE reference · exploit
- https://gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20CVE reference
- [ignite-user] 20191213 Re: H2 version security concernCVE reference · mailing-list
- RHSA-2020:0727CVE reference · vendor-advisory
- https://security.netapp.com/advisory/ntap-20240726-0003/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.