Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-6038

Good to know:

icon

Date: November 16, 2023

A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.

Language: Java

Severity Score

Related Resources (4)

https://github.com/h2oai/h2o-3
https://nvd.nist.gov/vuln/detail/CVE-2023-6038
https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c
https://www.mend.io/vulnerability-database/CVE-2023-6038

Severity Score

Weakness Type (CWE)

Missing Authorization

CWE-862

Path Traversal: '..filename'

CWE-29

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us