CVE-2024-6863
MEDIUMDescription
In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.
Is your site exposed to CVE-2024-6863?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| h2o | h2o |
References
Frequently Asked Questions
What is CVE-2024-6863? +
How severe is CVE-2024-6863? +
What products are affected by CVE-2024-6863? +
How do I check if I'm vulnerable to CVE-2024-6863? +
Related Vulnerabilities
A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence …
The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without …
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** …
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by …
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() …
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named …