LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23463: XML External Entity (XXE) Injection

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-23463 is an XXE flaw in the H2 Java database library. If an application uses affected H2 versions and processes SQLXML in the vulnerable path, a low-privileged user may cause sensitive data exposure or availability impact. The bundle does not show active exploitation.

Executive priority

Prioritize remediation where H2 is present in production, bundled in enterprise products, or reachable by low-privileged users. The issue is high severity, but urgency should be based on confirmed dependency exposure and reachable SQLXML processing, not assumed internet-wide exploitation.

Technical view

com.h2database:h2 versions 1.4.198 before 2.0.202 are vulnerable in org.h2.jdbc.JdbcSQLXML when SQLXML data from JdbcResultSet.getSQLXML() is later requested as DOMSource.class through getSource(). The CVSS 3.1 score is 8.1 with high confidentiality and availability impact.

Likely exposure

Exposure is most likely in Java applications embedding H2 and allowing low-privileged users or application flows to store or process XML SQLXML data. Systems using H2 only for isolated local testing have lower business exposure, but packaged products may still inherit the vulnerable dependency.

Exploitation context

The source bundle lists exploit maturity as proof-of-concept through CVSS E:P, but KEV is false and no cited source here confirms active exploitation. Practical risk depends on whether attackers can reach the vulnerable SQLXML parsing path through the application.

Researcher notes

The vulnerable condition is specific: parsed string data returned via JdbcResultSet.getSQLXML() and then getSource(DOMSource.class). The available bundle identifies the affected range and patch references, but does not provide complete downstream product impact details or active exploitation evidence.

Mitigation direction

  • Upgrade com.h2database:h2 to 2.0.202 or later.
  • Check vendor advisories for products bundling H2, including Oracle and NetApp guidance.
  • Inventory Java dependencies for vulnerable H2 versions.
  • Reduce untrusted XML processing paths until patched.
  • Treat reachable SQLXML parsing features as higher priority.

Validation and detection

  • Search dependency manifests and SBOMs for com.h2database:h2 versions before 2.0.202.
  • Confirm runtime artifacts do not bundle older H2 JARs transitively.
  • Review code paths using JdbcResultSet.getSQLXML() and JdbcSQLXML.getSource().
  • Check vendor product matrices for Oracle or NetApp affected software.
  • Verify upgraded builds resolve H2 to 2.0.202 or later.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-23463 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P2.85.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2021-23463Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/acom.h2database:h20, unspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.