Vulnerability in H2o
CVE-2024-6863
In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.
EPSS: 0.003 (25.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- H2o — versions 3.46.0
- H2oai H2oai/h2o-3 — versions unspecified
Weakness classification (CWE)
References
- security@huntr.dev (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-6863?
- CVE-2024-6863 is a medium-severity vulnerability in H2o, classified under CWE-749. CVSS score: 6.5/10. Published 2025-03-20.
- How severe is CVE-2024-6863?
- Medium severity. CVSS v3 base score is 6.5 out of 10.