CVE-2018-14335

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function...

6.5 MediumPublic exploit

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

13.2%Up 8.7 points since Apr 14, 2021

What each source reports

CVE List 6.5

Record: CVE-2018-14335
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-276
Updated: 2026-11-02

EUVDEUVD-2018-6257 6.5

Record: EUVD-2018-6257
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wm64-883p-84j3 6.5

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function...

Record: GHSA-wm64-883p-84j3
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-59, CWE-276, CWE-277
Updated: 2026-11-02

NVD 6.5

Record: CVE-2018-14335
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-59, CWE-276
Updated: 2026-11-02

OSV 6.5

Record: CVE-2018-14335
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-14335 6.5

Record: UBUNTU-CVE-2018-14335
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

h2database h2

Affected packages

Affected packages
Package	Affected	Fixed
`h2database` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.4.185-11.4.185-21.4.190-11.4.191-11.4.191-1ubuntu0.1~esm1	None known
`h2database` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.4.196-11.4.196-21.4.196-2ubuntu0.1~esm1	None known
`h2database` Ubuntu:20.04:LTS	All versions, plus listed versions 1.4.197-41.4.197-4+deb10u1build0.20.04.1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	H2 Database 1.4.197 - Information Disclosure	2018-07-30

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-14335 is a medium vulnerability (CVSS 6.5) in H2database H2, published July 24, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.2%, the 96th percentile. No source names a fixed version.

References

Show 4 moreShow less