CVE-2022-45868
Password exposure in H2 Database
CVE-2022-45868 is a high vulnerability (CVSS 8.4) in H2database H2, published November 23, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in com.h2database:h2 2.2.220.
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
- Record
CVE-2022-45868- CVSS 3.1
- 8.4 High
CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2022-7189
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
- Record
EUVD-2022-7189- CVSS 3.1
- 8.4 High
CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-22wj-vf5f-wrvj
Password exposure in H2 Database
The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that."
- Record
GHSA-22wj-vf5f-wrvj- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200, CWE-312
- Updated
- 2026-11-02
NVD
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
- Record
CVE-2022-45868- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-312
- Updated
- 2026-11-02
OSV
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
- Record
CVE-2022-45868- CVSS 3.1
- 8.4 High
CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-45868
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
- Record
DEBIAN-CVE-2022-45868- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSVGHSA-22wj-vf5f-wrvj
Password exposure in H2 Database
The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that."
- Record
GHSA-22wj-vf5f-wrvj- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200, CWE-312
- Updated
- 2026-11-02
OSVRHLW-2026-7a34ef2db32d7967
Lightwell Security Advisory: h2 2.2.219.rhlw-00001
Red Hat Lightwell has released com.h2database:h2 2.2.219.rhlw-00001 with a backported security fix.
CVE-2022-45868: The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
This patched artifact is a drop-in replacement for com.h2database:h2 2.2.219 from Maven Central.
- Record
RHLW-2026-7a34ef2db32d7967- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1763597218 No score
TuxCare security update for com.h2database:h2 (4 CVEs)
TuxCare rebuilt com.h2database:h2 to address 4 CVEs. Fixed in 1.4.200-tuxcare.1.
- Record
CLSA-2025-1763597218- Updated
- 2026-11-02
OSVCLSA-2026-1786683223 No score
TuxCare security update for com.h2database:h2 (1 CVE)
TuxCare rebuilt com.h2database:h2 to address 1 CVE. Fixed in 2.1.210-tuxcare.1.
- Record
CLSA-2026-1786683223- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2022-45868 No score
CVE-2022-45868 in com.h2database:h2 - Patched by Root
Root has patched CVE-2022-45868 in the com.h2database:h2 package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2022-45868- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.h2database:h2Maven |
1.4.198 up to 2.2.220 | 2.2.220 |
com.h2database:h2TuxCare:Maven |
1.4.200 up to 1.4.200-tuxcare.1 | 1.4.200-tuxcare.1 |
com.h2database:h2TuxCare:Maven |
2.1.210 up to 2.1.210-tuxcare.1 | 2.1.210-tuxcare.1 |
h2databaseDebian:12 |
All versions, plus listed versions 2.1.214-12.2.220-12.5.252-12.5.252-2 |
None known |
h2databaseDebian:13 |
All versions, plus listed versions 2.2.220-12.5.252-12.5.252-2 |
None known |
h2databaseDebian:14 |
All versions, plus listed versions 2.2.220-12.5.252-12.5.252-2 |
None known |
com.h2database:h2Maven |
1.4.198 up to 2.2.220, plus listed versions 1.4.1991.4.2002.0.2022.0.2042.0.2062.1.2102.1.2122.1.214 |
2.2.220 |
com.h2database:h2Red Hat Lightwell:Maven |
before 2.2.219.rhlw-00001, plus listed versions 1.0.200612171.0.200703041.0.200704291.0.200706171.0.57 Show 45 moreShow less1.0.581.0.591.0.601.0.611.0.621.0.631.0.641.0.651.0.661.0.671.0.681.0.691.0.701.0.711.0.721.0.731.0.741.0.751.0.761.0.771.0.781.0.791.1.1001.1.1011.1.1021.1.1031.1.1041.1.1051.1.1061.1.1071.1.1081.1.1091.1.1101.1.1111.1.1121.1.1131.1.1141.1.1151.1.1161.1.1171.1.1181.1.1191.2.1201.2.1211.2.122 |
2.2.219.rhlw-00001 |
com.h2database:h2Root:Maven |
before 2.1.214-aikido.1 | 2.1.214-aikido.12.1.214-aikido.2 |
io.root.com.h2database:h2Root:Maven |
before 2.1.214-root.io.1 | 2.1.214-root.io.12.1.214-root.io.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243
github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/WebServer.java
Left out here: 85 versions. The JSON record has them.