In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2 | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2 - Exploit, Third Party Advisory | |
| First Time |
H2o
H2o h2o |
|
| CPE | cpe:2.3:a:h2o:h2o:3.46.0:*:*:*:*:*:*:* |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:55
NVD link : CVE-2024-6854
Mitre link : CVE-2024-6854
JSON object : View
Products Affected
h2o
- h2o
CWE
CWE-36
Absolute Path Traversal