CVE-2018-14335: Infoleak
An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14335?
The severity of CVE-2018-14335 is medium with a CVSS score of 6.5.
What is the description of CVE-2018-14335?
CVE-2018-14335 is an issue in H2 1.4.197 where insecure handling of permissions in the backup function allows attackers to read sensitive files via a symlink to a fake database file.
How does CVE-2018-14335 affect H2database H2 version 1.4.197?
CVE-2018-14335 affects H2database H2 version 1.4.197 by allowing attackers to read sensitive files outside of their permissions.
Are there any references for CVE-2018-14335?
Yes, you can find references for CVE-2018-14335 at the following links: [Link 1](https://gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1610878), [Link 3](https://access.redhat.com/support/policy/updates/jboss_notes).
Which Common Weakness Enumeration (CWE) categories does CVE-2018-14335 belong to?
CVE-2018-14335 belongs to CWE-200 and CWE-59.