CVE-2024-10572

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-10572
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10572.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10572
Aliases
Published
2025-03-20T10:09:28.736Z
Modified
2026-07-15T01:49:00.231771599Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Denial of Service and Arbitrary File Write in h2oai/h2o-3
Details

In h2oai/h2o-3 version 3.46.0.1, the run_tool command exposes classes in the water.tools package through the ast parser. This includes the XGBoostLibExtractTool class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10572.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/h2oai/h2o-3

Affected ranges

Type
GIT
Repo
https://github.com/h2oai/h2o-3
Events
Introduced
a35cd8a449055c283049e880e77b52bbd7e976e5
Last affected
a35cd8a449055c283049e880e77b52bbd7e976e5
Database specific 
{
    "cpe": "cpe:2.3:a:h2o:h2o:3.46.0.1:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.46.0.1"
        },
        {
            "last_affected": "3.46.0.1"
        }
    ]
}

Affected versions

3.*
3.46.0.1
jenkins-3.*
jenkins-3.46.0.1
jenkins-rel-3.*
jenkins-rel-3.46.0-1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10572.json"