| Package | Affected versions | Patched versions |
|---|---|---|
| h2o | < 3.46.0.1 | 3.46.0.1 |
| h2o | = 3.40.0.4 |
Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting as CSV.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free