| Package | Affected versions | Patched versions |
|---|---|---|
| ai.h2o:h2o-core | ≥ 3.10.4.1, ≤ 3.46.0 | |
| h2o | ≥ 3.10.4.1, ≤ 3.46.0 | |
| h2o | = 3.46.0 |
In h2oai/h2o-3 version 3.46.0, the /99/Models/{name}/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free