CVE-2022-45868: Password exposure in H2 Database
Summary
CVE-2022-45868: Password exposure in H2 Database. Affects com.h2database:h2 versions >= 1.4.198, < 2.2.220. Fixed in 2.2.220. How to fix ↓
Also tracked for
- h2database · Debian:11
The same CVE-2022-45868 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2 Database Engine is an open-source relational database management system written in Java. It provides a web-based admin console for managing the database. The vulnerability in question allows the password for the web admin console to be specified in cleartext via the command line interface (CLI). This means that a local user or an attacker with local access can discover the password by listing processes and their arguments.
Vulnerability Detail
The vulnerability arises from the ability to start the web-based admin console with the argument -webAdminPassword, which exposes the password in cleartext. While the vendor argues that this is not a vulnerability of H2 Console and that passwords should never be passed on the command line, it still poses a security risk. An attacker who gains local access can easily obtain the password and potentially gain unauthorized access to the web admin console and the associated database. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Latest published version: 2.5.252 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.220
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is essential to ensure that passwords are not passed on the command line and are stored securely.
Conclusion
The vulnerability in H2 Database Engine allows the password for the web admin console to be exposed in cleartext via the command line interface. While the vendor argues that it is not a vulnerability of H2 Console, it still poses a security risk and can lead to unauthorized access to the console and the associated database. It is recommended to follow security best practices and avoid passing passwords on the command line. Update to version 2.2.220 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.h2database:h2 →
FAQ
The vulnerability allows an attacker with local access to discover the password for the web admin console, potentially leading to unauthorized access to the console and the associated database.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the fix for this vulnerability is available in version 2.2.220 of the H2 Database Engine. It is recommended to update to this version or later to mitigate the risk.
No, this vulnerability requires local access to the system to discover the password. However, it is still a significant security risk and should be addressed promptly.
To prevent this vulnerability, it is crucial to avoid passing passwords on the command line. Instead, use secure methods for managing passwords, such as storing them in encrypted configuration files or using environment variables.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.h2database:h2.
