Skip to main content

Absolute Path Traversal

CVE-2024-6854

High
7.1/10

Summary

In h2oai/h2o-3, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker. This issue affects both Maven-ai.i.h2o:h2o-core, and Pypi-h2o packages versions 3.32.1.1 and after.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-36 - Absolute Path Traversal

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

References

Advisory Timeline

  • Published