CVE-2024-5986

{"id": "CVE-2024-5986", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2026-02-02T11:16:16.737", "references": [{"url": "https://huntr.com/bounties/64ff5319-6ac3-4447-87f7-b53495d4d5a3", "source": "security@huntr.dev"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the `/3/Frames/framename/export` endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files."}, {"lang": "es", "value": "Una vulnerabilidad en h2oai/h2o-3 versi\u00f3n 3.46.0.1 permite a atacantes remotos escribir datos arbitrarios en cualquier archivo del servidor. Esto se logra explotando el endpoint '/3/Parse' para inyectar datos controlados por el atacante como la cabecera de un archivo vac\u00edo, que luego se exporta usando el endpoint '/3/Frames/framename/export'. El impacto de esta vulnerabilidad incluye el potencial de ejecuci\u00f3n remota de c\u00f3digo y acceso completo al sistema que ejecuta h2o-3, ya que los atacantes pueden sobrescribir archivos cr\u00edticos como claves SSH privadas o archivos de script."}], "lastModified": "2026-04-15T14:34:27.800", "sourceIdentifier": "security@huntr.dev"}