{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T03:08:10.804","vulnerabilities":[{"cve":{"id":"CVE-2024-10553","sourceIdentifier":"security@huntr.dev","published":"2025-03-20T10:15:17.513","lastModified":"2025-07-14T13:43:55.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0."},{"lang":"es","value":"Una vulnerabilidad en la API REST h2oai/h2o-3, versiones 3.46.0.4, permite a atacantes remotos no autenticados ejecutar código arbitrario mediante la deserialización de datos no confiables. La vulnerabilidad existe en los endpoints POST /99/ImportSQLTable y POST /3/SaveToHiveTable, donde las URL JDBC controladas por el usuario se pasan a DriverManager.getConnection, lo que provoca la deserialización si hay un controlador MySQL o PostgreSQL disponible en la ruta de clases. Este problema se ha corregido en la versión 3.47.0."}],"metrics":{"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:h2o:h2o:3.46.0.4:*:*:*:*:*:*:*","matchCriteriaId":"DBBE6211-09B7-4E25-8712-D12AA6AEF814"}]}]}],"references":[{"url":"https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac","source":"security@huntr.dev","tags":["Patch"]},{"url":"https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b","source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"]}]}}]}