H2O local file inclusion vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-6038 · ADVISORY
• h2oai/h2o-3 · PACKAGE
• huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c · WEB

ai.h2o:h2o-core のその他の脆弱性

• CVE-2026-3960緊急 9.8A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 …
• CVE-2024-5986緊急 9.1A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved …
• CVE-2025-6544緊急 9.8A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute ar…
• CVE-2024-8616高 8.2In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerabi…
• CVE-2024-8062高 7.5A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` reque…