← volver
CVE-2018-10054

CVE-2018-10054

30Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 34%
de la publicación al arma0 días
Publicada en NVD11 abr
metasploit9 abr
probabilidad de explotación
34%top 2% de las CVE
explotación observada
noninguna fuente lo reporta
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."
Productos afectados
n/a · n/a
Referencias
http://blog.datomic.com/2018/03/important-security-update.htmlhttps://forum.datomic.com/t/important-security-update-0-9-5697/379https://github.com/h2database/h2database/issues/1225https://github.com/h2database/h2database/issues/1808#issuecomment-599203115https://github.com/h2database/h2database/issues/3099https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3Ehttps://mthbernardes.github.io/rce/2018/03/14/abusing-h2-database-alias.htmlhttps://security.netapp.com/advisory/ntap-20240719-0003/https://www.exploit-db.com/exploits/44422/