Description
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| h2oai | h2oai/h2o-3 | unspecified – ≤ latest | — |
High · 8.7
CVE-2023-6017
EUVD-2023-58282GHSA-pwcm-766j-45vc
H2O S3 Bucket Takeover
Published Nov 16, 2023 · Updated Aug 2, 2024 · Assigned by @huntr_ai