External Control of File Name or Path in h2oai/h2o-3
CVE-2023-6569

9.3CRITICAL

Key Information:

Vendor

H2oai

Status
H2oai/h2o-3
Vendor
CVE Published:
14 December 2023

What is CVE-2023-6569?

The vulnerability in H2O-3 allows an attacker to manipulate file names or paths externally, leading to potential unauthorized file access and manipulation. This flaw could compromise the integrity of data and applications that rely on safe file handling practices, posing significant risks to systems utilizing H2O.ai solutions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

h2oai/h2o-3 <= unspecified

References

https://huntr.com/bounties/a5d003dc-c23e-4c98-8dcf-35ba92...

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

CVSS V3.0

Score:
9.3
Severity:
CRITICAL
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.