Which products and versions are affected by CVE-2022-23221?

Affected: H2 (H2database); Communications Cloud Native Core Console (Oracle) versions 1.9.0; Debian Linux versions 10.0, 11.0, 9.0, among others. The full list is in the CVE brief.

Is CVE-2022-23221 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2022-23221 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2022-23221?

Public exploit code is available.

Is there a fix for CVE-2022-23221?

Fixed versions are available, including com.h2database:h2 1.4.196+sp999, com.h2database:h2 2.1.210, eap7-apache-cxf 0:3.4.10-1.SP1_redhat_00001.1.el7eap.

How urgently should CVE-2022-23221 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2022-23221

CriticalPublic exploit

Arbitrary code execution in H2 Console

Published Jan 21, 2022 · Updated Aug 12, 2026 · Also known as DEBIAN-CVE-2022-23221, GHSA-45hx-wfhj-473x, UBUNTU-CVE-2022-23221

Key Facts

Patch immediately

CVE-2022-23221 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting H2 (H2database), Communications Cloud Native Core Console (Oracle), Debian Linux and 15 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 65% probability of exploitation in the next 30 days.
Fixed versions are available, including com.h2database:h2 1.4.196+sp999, com.h2database:h2 2.1.210, eap7-apache-cxf 0:3.4.10-1.SP1_redhat_00001.1.el7eap.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

65%

Higher than 99.2% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2022-23221 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

Affected Products

39 affected entries in total

Product	Affected versions	Fixed in
H2H2database	See advisory	2.0.206
Communications Cloud Native Core ConsoleOracle	1.9.0	n/a
Debian LinuxDebian	10.0, 11.0, 9.0	n/a
h2databasedebian	See advisory	1.4.197-4+deb11u1
com.h2database:h2maven	See advisory	2.1.210

13 more affected products in the full CVE brief

Patched Releases

com.h2database:h2

1.4.196+sp999, 2.1.210

eap7-apache-cxf

0:3.4.10-1.SP1_redhat_00001.1.el7eap

eap7-avro

0:1.7.6-8.redhat_00003.1.el7eap

eap7-h2database

0:1.4.197-2.redhat_00004.1.el7eap, 0:1.4.197-2.redhat_00004.1.el8eap

eap7-jboss-annotations-api_1.3_spec

0:2.0.1-4.Final_redhat_00001.1.el7eap

eap7-jboss-marshalling

0:2.0.15-1.Final_redhat_00001.1.el7eap

eap7-jboss-server-migration

0:1.7.2-12.Final_redhat_00013.1.el7eap

eap7-jboss-xnio-base

0:3.7.13-1.Final_redhat_00001.1.el7eap

eap7-log4j-jboss-logmanager

0:1.2.2-2.Final_redhat_00002.1.el7eap

eap7-wildfly

0:7.3.11-4.GA_redhat_00002.1.el7eap

eap7-wss4j

0:2.3.3-2.redhat_00001.1.el7eap

eap7-xalan-j2

0:2.7.1-38.redhat_00015.1.el7eap

eap7-xml-security

0:2.2.3-2.redhat_00001.1.el7eap

h2database

1.4.191-1ubuntu0.1~esm1, 1.4.193-1+deb9u1, 1.4.196-2ubuntu0.1~esm1, 1.4.197-4+deb10u1, 1.4.197-4+deb10u1build0.20.04.1, 1.4.197-4+deb11u1, 2.1.210-1, 2.1.210+really1.4.197-1

2.0.206

seal.sp1.com.h2database:h2

1.4.196+sp999

Timeline

Publicly disclosed
Jan 21, 2022
Last updated
Aug 12, 2026

Weakness Type

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-502 Deserialization of Untrusted Data

References

15 more references in the full CVE brief

FAQ

Common Questions.

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
Affected: H2 (H2database); Communications Cloud Native Core Console (Oracle) versions 1.9.0; Debian Linux versions 10.0, 11.0, 9.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including com.h2database:h2 1.4.196+sp999, com.h2database:h2 2.1.210, eap7-apache-cxf 0:3.4.10-1.SP1_redhat_00001.1.el7eap.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2022-23221 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.