-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from insecure defaults in the H2 webconsole configuration. The key vulnerable function was in WebModuleH2Console.java's init method, which explicitly set 'webAllowOthers=true' during servlet registration. This allowed remote database access without authentication by default in prototype mode. The patch removed this hardcoded parameter and introduced configuration checks (via isis.prototyping.h2-console.web-allow-remote-access), confirming this was the vulnerable code path. The function's direct manipulation of security-critical parameters without safeguards matches the CWE-1188 (Insecure Default Initialization) description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.isis.core:isis-core | maven | < 2.0.0-M8 | 2.0.0-M8 |