CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.2. It affects Java.
CVE
CVE-2024-8616
Severity
HIGH
CVSS
8.2
EPSS
0.51%
Java
Original NVD Description
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
Related CVEs
Other vulnerabilities affecting the same vendor(s)