GitHub Advisoryadvisory · Maven

GHSA-6mv8-95x5-xcq9 H2O local file inclusion vulnerability

CRITICAL Published 2023-11-16 Modified 2024-04-16 Official page ↗
Aliases
CVE-2023-6038
Ecosystem
Maven
Packages
ai.h2o:h2o-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Weaknesses
CWE-29, CWE-862
Reviewed
2024-02-08

Affected packages

• Maven ai.h2o:h2o-core: <= 3.40.0.4 (no fix yet)

Description

A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.

Related

Alias · CVE (1)

  • CVE-2023-6038 A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files… vulnerability

Weakness · CWE (2)

  • CWE-29 Path Traversal: '\..\filename' weakness
  • CWE-862 Missing Authorization weakness

References