CVE-2024-8616High· 8.2▾ TwilightH2O Vulnerable to Arbitrary File Overwrite
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.5%
In h2oai/h2o-3 version 3.46.0, the /99/Models/{name}/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
h2o >= 3.10.4.1, <= 3.46.0ai.h2o:h2o-core >= 3.10.4.1, <= 3.46.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-5550Medium· 5.3Arbitrary system path lookup in h20
CVE-2024-10549High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
CVE-2024-10572High· 7.5H2O Vulnerable to Denial of Service (DoS) and File Write
CVE-2024-7768High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
CVE-2024-6863Medium· 6.5H2O Vulnerable to Execution of Arbitrary Files
CVE-2024-10550High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint