In breve
- CVE-2024-8616 è una vulnerabilità ALTO (CVSS 8.2) che riguarda ai.h2o:h2o-core, h2o, h2o (h2o).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.56%, superiore al 46.4% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
| Package | Affected versions | Patched versions |
|---|
| ai.h2o:h2o-core Maven | ≥ 3.10.4.1, ≤ 3.46.0
| No fix yet |
| h2o PyPI | ≥ 3.10.4.1, ≤ 3.46.0
| No fix yet |
| h2o | = 3.46.0
| No fix yet |
Description
In h2oai/h2o-3 version 3.46.0, the /99/Models/{name}/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
NVD description
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free