CVE-2024-45758: Critical severity h2o.ai h2o-3 vulnerability
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connectionurl property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45758?
CVE-2024-45758 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-45758?
To remediate CVE-2024-45758, upgrade H2O.ai H2O to version 3.46.0.5 or later, which addresses the vulnerability.
What are the implications of CVE-2024-45758?
CVE-2024-45758 allows attackers to set arbitrary JDBC URLs, which may lead to deserialization attacks, unauthorized file reads, and command execution.
What versions of H2O.ai H2O are affected by CVE-2024-45758?
H2O.ai H2O versions up to and including 3.46.0.4 are affected by CVE-2024-45758.
Can CVE-2024-45758 be exploited without authentication?
Yes, CVE-2024-45758 can be exploited without authentication, allowing attackers to exploit the vulnerability if they can send a request to the ImportSQLTable URI.