Published: 06/10/2022 Updated: 03/02/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

Vulnerable Product	Search on Vulmon	Subscribe to Product
hsqldb hypersql database
debian debian linux 10.0
debian debian linux 11.0

Debian Bug report logs - #1023573 hsqldb: CVE-2022-41853 Package: src:hsqldb; Maintainer for src:hsqldb is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 6 Nov 2022 20:24:02 UTC Severity: important Tags: security, upstream Fou ...

It was found that those using javasqlStatement or javasqlPreparedStatement in hsqldb, a Java SQL database, to process untrusted input may be vulnerable to a remote code execution attack By default it is allowed to call any static method of any Java class in the classpath resulting in code execution The issue can be prevented by updating to 2 ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 7410 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 74Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 7410 on RHEL 9 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Applicatio ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 7410 on RHEL 8 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Applicatio ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 7410 on RHEL 7 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Applicatio ...

Synopsis Important: hsqldb security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for hsqldb is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a se ...

Synopsis Important: hsqldb security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for hsqldb is now available for Red Hat Enterprise Linux 6 Extended Lifecycle SupportRed Hat Product Security has rated ...

Synopsis Important: Red Hat Fuse 7111 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 711 to 7111) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this updat ...

Those using javasqlStatement or javasqlPreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack By default it is allowed to call any static method of any Java class in the classpath resulting in code execution The issue can be prevented by updating to 271 or by setting th ...

DescriptionThe MITRE CVE dictionary describes this issue as: Those using javasqlStatement or javasqlPreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack By default it is allowed to call any static method of any Java class in the classpath resulting in code execution The ...

Treats CSV and JSON files as SQL tables, and exports SQL SELECTs back to CSV or JSON.

CSV + JSON Cruncher - query and process your CSV and JSON files using SQL A tool which treats CSV and JSON files as SQL tables, performs SQL SELECT queries on them, and stores the result into CSV and JSON files Many tools and systems can export their data to CSV - comma separated values Typical work with these data is importing them into some spreadsheet like Excel and pro

Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack

Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack Those using javasqlStatement or javasqlPreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack By default it is allowed to call any static method of any Java class in the classpat

MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal

MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal An issue was discovered in Liferay - Portal <=74312-ga12 By inserting malicious content in the FTL Templates, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and perform SSRF (Server-Side Request Forgery), re

NVD-CWE-noinfo http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50212#c7 https://lists.debian.org/debian-lts-announce/2022/12/msg00020.html https://www.debian.org/security/2023/dsa-5313 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023573 https://nvd.nist.gov https://github.com/OndraZizka/csv-cruncher https://www.debian.org/security/2023/dsa-5313

Get Started

CVE-2022-41853

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect