Description
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| h2oai | h2oai/h2o-3 | unspecified – ≤ latest | — |
Critical · 10.0
CVE-2023-6016
EUVD-2023-58281GHSA-p3v8-5qc4-7p8r
H2O Remote Code Execution via POJO Model Import
Published Nov 16, 2023 · Updated Aug 2, 2024 · Assigned by @huntr_ai