Custom Encryption Tool Vulnerability in h2o.ai's H2O-3

CVE-2024-6863

What is CVE-2024-6863?

In H2O-3 version 3.46.0, an exposed endpoint for a custom EncryptionTool allows attackers to encrypt arbitrary files on the server. This vulnerability enables the attacker to select their encryption key, which can also be overwritten at will, leading to potential ransomware conditions. Consequently, organizations may struggle to restore access to encrypted files, heightening the risk of data loss and operational disruption.

References