S3 Bucket Takeover Vulnerability in h2o-3 Repository
CVE-2024-1456

7.1HIGH

Key Information:

Vendor

H2oai

Status
H2oai/h2o-3
Vendor
CVE Published:
16 April 2024

What is CVE-2024-1456?

A vulnerability has been identified in the H2O-3 repository by H2O.ai, concerning the S3 bucket at 'http://s3.amazonaws.com/h2o-training'. This flaw allows unauthorized takeover of the S3 bucket, which can lead to potential exposure of sensitive data. Organizations utilizing this product should take immediate steps to secure their S3 configurations and assess any risks related to this vulnerability.

Affected Version(s)

h2oai/h2o-3 <= unspecified

References

https://huntr.com/bounties/7c1b7f27-52f3-4b4b-9d81-e277f5...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.