The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the     argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin     console. Consequently, a local user (or an attacker that has obtained local access through some means)     would be able to discover the password by listing processes and their arguments. NOTE: the vendor states     This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and     every qualified DBA or system administrator is expected to know that. Nonetheless, the issue was fixed in     2.2.220. (CVE-2022-45868)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the
    argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin
    console. Consequently, a local user (or an attacker that has obtained local access through some means)
    would be able to discover the password by listing processes and their arguments. NOTE: the vendor states
    "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and
    every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in
    2.2.220. (CVE-2022-45868)

ID	Name	Product	Family	Severity
257700	Linux Distros Unpatched Vulnerability : CVE-2022-45868	Nessus	Misc.	high
421769	SCA: security update for com.h2database:h2 (GHSA-22wj-vf5f-wrvj)	Tenable Cloud Security	SCA Checks	high
421769	SCA: security update for com.h2database:h2 (GHSA-22wj-vf5f-wrvj)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2022-45868

high

Tenable Plugins

high

high

high