CVE-2024-6854

Katalog CVE

CVSS 7.1 · High EPSS 0,78%

Kerentanan Absolute Path Traversal pada h2o. Skor CVSS 3.0 7.1 (High) menurut huntr.dev.

Deskripsi (NVD)

In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

7.1 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-36: Absolute Path Traversal

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2 exploit · advisory pihak ketiga