CVE-2023-6038: H2O Local File Include
First published: Thu Nov 16 2023(Updated: )
An attacker is able to read any file on the server hosting the H2O dashboard without any authentication.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| H2o H2o |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-6038?
CVE-2023-6038 is a vulnerability in H2O, a popular web server, that allows an attacker to read any file on the server hosting the H2O dashboard without any authentication.
How severe is CVE-2023-6038?
CVE-2023-6038 has a severity rating of 9.3 (critical).
What software is affected by CVE-2023-6038?
H2O is affected by CVE-2023-6038.
How can an attacker exploit CVE-2023-6038?
An attacker can exploit CVE-2023-6038 to read any file on the server hosting the H2O dashboard without any authentication.
Is there a fix for CVE-2023-6038?
Currently, there is no known fix for CVE-2023-6038. It is recommended to keep the H2O software up to date and follow any available security recommendations from the vendor.
- collector/mitre-cve
- collector/nvd-api
- vendor/h2o
- product/h2o
- canonical/h2o h2o