Auth bypass in H2o
CVE-2023-6038
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
Vulnerability class: Broken Access Control
EPSS: 0.043 (90.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- H2o
- H2oai H2oai/h2o-3 — versions unspecified
Weakness classification (CWE)
References
- security@huntr.dev (Exploit)
Frequently asked questions
- What is CVE-2023-6038?
- CVE-2023-6038 is a high-severity vulnerability in H2o, classified under Missing Authorization. CVSS score: 7.5/10. Published 2023-11-16.
- How severe is CVE-2023-6038?
- High severity. CVSS v3 base score is 7.5 out of 10.