← Vulnerability feed

Vulnerability record · CVE-2022-45868 · published 23 November 2022

CVE-2022-45868: H2database h2 cleartext storage of sensitive data vulnerability

H2database · H2

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.

7.8 CVSS 3.1 High EPSS 0.31% · top 78.6% CWE-312 · Cleartext storage of sensitive data
7.8CVSS 3.1 base score
0.31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/advisories/GHSA-22wj-vf5f-wrvj
https://github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/Web Third Party Advisory
https://github.com/h2database/h2database/issues/3686
https://github.com/h2database/h2database/pull/3833
https://github.com/h2database/h2database/releases/tag/version-2.2.220
https://sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243 ExploitThird Party Advisory
https://github.com/advisories/GHSA-22wj-vf5f-wrvj
https://github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/Web Third Party Advisory
https://github.com/h2database/h2database/issues/3686
https://github.com/h2database/h2database/pull/3833
https://github.com/h2database/h2database/releases/tag/version-2.2.220
https://sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243 ExploitThird Party Advisory

Track CVE-2022-45868 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-23221H2 Console JDBC URL argument injection enables remote code executionH2 Console before 2.1.210 accepts a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, …EPSS 65%analysed9.8CVE-2021-42392H2 database JNDI lookup flaw allows unauthenticated remote code executionThe org.h2.util.JdbcUtils.getConnection method in the H2 database accepts a driver class name and database URL from the caller. An attacker can suppl…EPSS 83%analysed9.1CVE-2021-23463H2database h2 xml external entity (xxe) vulnerabilityThe package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML cl…EPSS 2.7%8.8CVE-2018-10054Cognitect datomic improper input validation vulnerabilityH2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.…EPSS 34%6.5CVE-2018-14335H2database h2 link following vulnerabilityAn issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of t…EPSS 13%5.7CVE-2011-4723D-Link DIR-300 router stores passwords in cleartextThe D-Link DIR-300 router stores passwords in cleartext rather than in a protected form. Anyone who can reach the stored data can read credentials di…KEVEPSS 3.1%analysed

Source: NIST National Vulnerability Database (record CVE-2022-45868), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.