CVE-2022-41853
Remote code execution in HyperSQL DataBase
- Published
- Updated
- Reserved
- Assigned by
Description
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GoogleCNA (assigner) | 3.1 | High8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 5.1% · top 7.5% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.
Weakness
Affected products
- affected unspecified – < 2.7.1
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.hsqldb:hsqldbGHSA-77xx-rxvh-q682 (opens in a new tab)
References (4)
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50212#c7 (opens in a new tab)x_transferred
- http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control (opens in a new tab)x_transferred
- [debian-lts-announce] 20221210 [SECURITY] [DLA 3234-1] hsqldb security update (opens in a new tab)mailing-listx_transferred
- DSA-5313 (opens in a new tab)vendor-advisoryx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-77xx-rxvh-q682 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-41853)Record last updated .