H2oai Security Vulnerabilities

CVE-2024-5979

In h2oai/h2o-3 version 3.46.0, the run_tool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of...

CVE-2024-1456

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized...

CVE-2024-5550

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead.....

CVE-2023-6038

A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction....

CVE-2023-6569

External Control of File Name or Path in...

CVE-2023-6013

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include...

CVE-2023-6016

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import...

CVE-2023-6017

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket...