CVE-2023-6038CWE-862

Local File Inclusion in h2oai/h2o-3

Critical · published November 16, 2023

CVSS v3.0
9.3
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.

The record
Technical detail
CVSS v3.0
9.3 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.04340 · 91.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-11-16T16:06Z
EPSS history
Timeline
  • 16 NOV 16:06Z
    Local File Inclusion in h2oai/h2o-3
    cvelistv5