Arbitrary File Overwrite in H2O.ai's Data Science Platform
CVE-2024-8616

8.2HIGH

Key Information:

Vendor

H2oai

Status
H2oai/h2o-3
Vendor
CVE Published:
20 March 2025

What is CVE-2024-8616?

A vulnerability in H2O-3, specifically in version 3.46.0, enables an attacker to exploit the /99/Models/{name}/json endpoint. The flaw is linked to the exportModelDetails function within ModelsHandler.java, where user-supplied input in the mexport.dir parameter can dictate file paths on the server. This puts the server at risk of allowing unauthorized file overwrites, potentially compromising system integrity and data confidentiality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

h2oai/h2o-3 <= unspecified

References

https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11...

CVSS V3.0

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.