CVE-2022-45868

DISPUTED The web-based admin console in H2 Database Engine before
2.2.220 can be started via the CLI with the argument -webAdminPassword,
which allows the user to specify the password in cleartext for the web
admin console. Consequently, a local user (or an attacker that has obtained
local access through some means) would be able to discover the password by
listing processes and their arguments. NOTE: the vendor states “This is not
a vulnerability of H2 Console … Passwords should never be passed on the
command line and every qualified DBA or system administrator is expected to
know that.” Nonetheless, the issue was fixed in 2.2.220.

Notes