CVE-2023-6038: Local File Inclusion in h2oai/h2o-3
Vulnerability summary
CVE-2023-6038 is a critical (CVSS 9.3) Missing Authorization vulnerability in h2o. EPSS estimates a 4.34% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 16-11-2023PublishedVulnerability first disclosed.
- 29-08-2024Last modifiedVulnerability information updated.
Description
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · MavenEcosystem advisory · calculated9.3CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
- NVDNIST9.3CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
EPSS trend
Probability
4.34%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.34% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ai.h2o1 product
- h2o-core≤ 3.40.0.4
H2o1 product
- h2ona
H2oai1 product
- h2oai/h2o-3≥ unspecified, ≤ latest
3 vendors · 3 products
References
3 links
- github.com/h2oai/h2o-3PACKAGE