Vulnerability in H2o
CVE-2024-6863
In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (26.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 26.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
- H2o — versions 3.46.0
- H2oai H2oai/h2o-3 — versions unspecified
Weakness classification (CWE)
References
- huntr.com/bounties/10f55937-0cba-4530-897f-2abf30ed5270 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-6863?
- CVE-2024-6863 is a medium-severity vulnerability in H2o, classified under CWE-749. CVSS score: 6.5/10. Published 2025-03-20.
- How severe is CVE-2024-6863?
- Medium severity. CVSS v3 base score is 6.5 out of 10.