CVE-2021-23463: 
H2 Database vulnerability analysis and mitigation

The vulnerability CVE-2021-23463 affects the H2 database package (com.h2database:h2) versions from 1.4.198 and before 2.0.202. It is an XML External Entity (XXE) Injection vulnerability that occurs in the org.h2.jdbc.JdbcSQLXML class object when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method (CVE Mitre, NVD).

The vulnerability is triggered when the JdbcSQLXML object executes the getSource() method with DOMSource.class as the parameter. This leads to unprotected parsing of XML, resulting in XXE. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (Critical), with network attack vector, low attack complexity, no privileges required, and no user interaction needed (Ubuntu Security, Snyk Report).

A successful exploitation of this vulnerability can result in total loss of confidentiality, allowing attackers to access sensitive information. Additionally, it can lead to a complete loss of availability, potentially resulting in denial of service conditions. The vulnerability has no impact on system integrity (Snyk Report).

The vulnerability has been fixed in H2 database version 2.0.202. Users are advised to upgrade to this version or later. The fix was implemented through a pull request that addresses the XXE vulnerability in the SQLXML implementation (GitHub PR).