PT-2024-39280 · H2O.Ai · H2O-3

Aftersnow

·

Published

2024-09-14

·

Updated

2024-09-20

·

CVE-2024-8862

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: h2oai h2o-3 version 3.46.0.4
Description: A critical issue has been found in the getConnectionSafe function of the component JDBC Connection Handler, affecting the file /dtale/chart-data/1. The manipulation of the query argument leads to deserialization. This issue can be initiated remotely. The vendor was contacted about this disclosure but did not respond.
Recommendations: For h2oai h2o-3 version 3.46.0.4, as a temporary workaround, consider disabling the getConnectionSafe function until a patch is available. Restrict access to the /dtale/chart-data/1 endpoint to minimize the risk of exploitation. Avoid using the query parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-74CWE-502

Related Identifiers

CVE-2024-8862
GHSA-FG5M-M723-7MV6

Affected Products

H2O-3