A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c | Exploit |
Configurations
History
16 Apr 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3. |
08 Feb 2024, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
24 Nov 2023, 23:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c - Exploit | |
| CWE | CWE-862 | |
| CPE | cpe:2.3:a:h2o:h2o:-:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
H2o h2o
H2o |
16 Nov 2023, 17:30
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-16 17:15
Updated : 2024-04-16 12:15
NVD link : CVE-2023-6038
Mitre link : CVE-2023-6038
CVE.ORG link : CVE-2023-6038
JSON object : View
Products Affected
h2o
- h2o
CWE
CWE-862
Missing Authorization