Arbitrary File Overwrite in H2O.ai's Data Science Platform
CVE-2024-8616

8.2HIGH

Key Information:

Vendor

H2oai

Status
H2oai/h2o-3
Vendor
CVE Published:
20 March 2025

What is CVE-2024-8616?

A vulnerability in H2O-3, specifically in version 3.46.0, enables an attacker to exploit the /99/Models/{name}/json endpoint. The flaw is linked to the exportModelDetails function within ModelsHandler.java, where user-supplied input in the mexport.dir parameter can dictate file paths on the server. This puts the server at risk of allowing unauthorized file overwrites, potentially compromising system integrity and data confidentiality.

Affected Version(s)

h2oai/h2o-3 <= unspecified

References

https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11...

CVSS V3.0

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2024-8616 : Arbitrary File Overwrite in H2O.ai's Data Science Platform