Back to Database
Status published
Unknown
CVE-2018-14335
An issue was discovered in H2 1.4.197. Insecure handling of...
Vulnerability Description
An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-14335
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.exploit-db.com/exploits/45105/
- https://gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20
- https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E
- https://access.redhat.com/errata/RHSA-2020:0727
- https://security.netapp.com/advisory/ntap-20240726-0003/
More from h2database
View All →CVE-2022-45868
The web-based admin console in H2 Database Engine before 2.2.220...
High
8.4
CVE-2022-23221
H2 Console before 2.1.210 allows remote attackers to execute arbitrary...
Unknown
0
CVE-2021-42392
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters...
Critical
9.8
Affected Vendor
h2database
View all reports →Affected Software
h2
Vulnerable Versions:
1.4.197
Timeline
Official Publish:
July 24th, 2018
Last Modified:
October 29th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.