-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the handling of the 'path' parameter in the /3/ImportFiles endpoint. The ImportFilesHandler.importFiles method is directly responsible for processing this parameter and initiating file imports. By not validating that the provided path doesn't reference the vulnerable endpoint itself, it allows recursive calls that exhaust server resources. The code structure shown in the provided Java file confirms the lack of safeguards around path validation before processing.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| h2o | pip | ||
| ai.h2o:h2o-core | maven |
Ongoing coverage of React2Shell