CVE-2024-8616highCWE-73

CVE-2024-8616: falha de alta gravidade em h2oai/h2o-3

Arbitrary File Overwrite in h2oai/h2o-3

Publicada em

Seguir esta CVE+ Monitorar h2oai/h2o-3+ Monitorar h2o

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.6%
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
h2oai · h2oai/h2o-3
CVEs relacionadas — h2oai/h2o-3

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6016CRITICALH2O Remote Code Execution via POJO Model ImportEPSS 30.6%CVE-2025-6507CRITICALDeserialization of Untrusted Data in h2oai/h2o-3EPSS 17.3%CVE-2023-6038CRITICALLocal File Inclusion in h2oai/h2o-3EPSS 4.3%CVE-2024-10553CRITICALJdbc Deserialization in h2oai/h2o-3EPSS 1.6%CVE-2025-6544CRITICALDeserialization Vulnerability in h2oai/h2o-3EPSS 1.0%CVE-2026-3960MEDIUMRemote Code Execution in h2oai/h2o-3EPSS 0.9%