In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11a8c97a | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:49
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
H2o
H2o h2o |
|
| CPE | cpe:2.3:a:h2o:h2o:3.46.0:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11a8c97a - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:49
NVD link : CVE-2024-8616
Mitre link : CVE-2024-8616
JSON object : View
Products Affected
h2o
- h2o
CWE
CWE-73
External Control of File Name or Path