Custom Encryption Tool Vulnerability in h2o.ai's H2O-3
CVE-2024-6863

6.5MEDIUM

Key Information:

Vendor

H2oai

Status
H2oai/h2o-3
Vendor
CVE Published:
20 March 2025

What is CVE-2024-6863?

In H2O-3 version 3.46.0, an exposed endpoint for a custom EncryptionTool allows attackers to encrypt arbitrary files on the server. This vulnerability enables the attacker to select their encryption key, which can also be overwritten at will, leading to potential ransomware conditions. Consequently, organizations may struggle to restore access to encrypted files, heightening the risk of data loss and operational disruption.

Affected Version(s)

h2oai/h2o-3 <= unspecified

References

https://huntr.com/bounties/10f55937-0cba-4530-897f-2abf30...

CVSS V3.0

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2024-6863 : Custom Encryption Tool Vulnerability in h2o.ai's H2O-3