Vulnerability Database
296,733
Total vulnerabilities in the database
CVE-2024-8616
In h2oai/h2o-3 version 3.46.0, the /99/Models/{name}/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
| Software | From | Fixed in |
|---|---|---|
h2o
|
3.10.4.1 | 3.46.0.x |
ai.h2o / h2o-core
|
3.10.4.1 | 3.46.0.x |
| h2o / h2o | 3.46.0 | 3.46.0.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime