What’s Vulnerable › Vulnerabilities

CVE-2024-1456: S3 Bucket Takeover in h2oai/h2o-3

• Severity: high (CVSS 7.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-16 · updated 2026-06-17
• Weakness: CWE-840

Description

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.

Affected products

• h2oai/h2o-3: 3.45.0.6386

References

• https://huntr.com/bounties/7c1b7f27-52f3-4b4b-9d81-e277f5e0ab6b
• https://huntr.com/bounties/7c1b7f27-52f3-4b4b-9d81-e277f5e0ab6b

Get alerted when CVE-2024-1456 or the next vulnerability affects your stack