What is the severity of CVE-2025-0782?

CVE-2025-0782 has been classified as a high severity vulnerability due to its potential to allow unauthorized public write access to sensitive files in the S3 bucket.

How do I fix CVE-2025-0782?

To fix CVE-2025-0782, reconfigure the S3 bucket permissions to ensure that public write access is disabled.

What impact does CVE-2025-0782 have on my files?

CVE-2025-0782 allows an attacker to overwrite any file in the affected 'h2o-release' S3 bucket, potentially compromising your application's integrity.

Which versions are affected by CVE-2025-0782?

CVE-2025-0782 affects all versions of h2oai/h2o-3, allowing for public write access regardless of the version.

Is CVE-2025-0782 exploitable remotely?

Yes, CVE-2025-0782 is exploitable remotely, allowing attackers to manipulate files in the S3 bucket without needing direct access to the system.

Vulnerability/
CVE-2025-0782

critical

CWE

862

2/5/2025

CVE-2025-0782: Missing Authorization in h2oai/h2o-3

First published: Fri May 02 2025(Updated: )

A vulnerability in the S3 bucket configuration for h2oai/h2o-3 allows public write access to the 'h2o-release' bucket. This issue affects all versions and could enable an attacker to overwrite any file in the bucket. As users download binary files such as JARs from this bucket, this vulnerability could lead to remote code execution (RCE) on any user who uses the application. Additionally, an attacker could modify the documentation to include malicious download links.

Credit: security@huntr.dev

Affected Software	Affected Version	How to fix
H2O-3	<=all

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2025-0782?
CVE-2025-0782 has been classified as a high severity vulnerability due to its potential to allow unauthorized public write access to sensitive files in the S3 bucket.
How do I fix CVE-2025-0782?
To fix CVE-2025-0782, reconfigure the S3 bucket permissions to ensure that public write access is disabled.
What impact does CVE-2025-0782 have on my files?
CVE-2025-0782 allows an attacker to overwrite any file in the affected 'h2o-release' S3 bucket, potentially compromising your application's integrity.
Which versions are affected by CVE-2025-0782?
CVE-2025-0782 affects all versions of h2oai/h2o-3, allowing for public write access regardless of the version.
Is CVE-2025-0782 exploitable remotely?
Yes, CVE-2025-0782 is exploitable remotely, allowing attackers to manipulate files in the S3 bucket without needing direct access to the system.

collector/mitre-cve
source/MITRE
agent/weakness
agent/title
agent/references
agent/type
agent/description
agent/first-publish-date
agent/guess-ai
agent/software-canonical-lookup
agent/softwarecombine
collector/nvd-api
source/NVD
agent/last-modified-date
agent/author
agent/severity
agent/source
agent/tags
agent/event
vendor/h2oai
canonical/h2o-3

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.