‹ Volver al listado

CVE-2023-6038

Alta (7.5)—Exploit
Parchear con prioridadHay código de explotación público (Plantilla de Nuclei (detección automática y masiva)). Sin explotación activa confirmada.
Gravedad7.5Alta · CVSS 3.1
Probabilidad de explotación4.34 %mayor que el 91 % de las CVE · dato del 5 nov 2026
Explotación activaNono figura en el catálogo de CISA · comprobado 6 nov, 02:00
Exploit públicoDisponiblePlantilla de Nuclei (detección automática y masiva)

Un atacante puede leer cualquier archivo en el servidor que aloja el panel de H2O sin ninguna autenticación.

Cronología

Elaborada con nuestros propios datos: NVD, CISA KEV, FIRST EPSS, exploits públicos, prensa especializada y la cobertura de Orbitaley.

  1. Registro CVE publicado en NVD
  2. Última modificación del registro en NVD
  3. Primer exploit público

Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

H2O — H2O

Registro NVD

Estado en NVD
Modificada
Publicada
16 nov 2023
Última modificación
17 jun 2026
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE)
CWE-862

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6038",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-6038",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-29T14:47:00.437902Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9.3,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "h2oai",
          "product": "h2oai/h2o-3",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "latest"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-16T17:15:09.373",
  "references": [
    {
      "url": "https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c",
      "tags": [
        "Exploit"
      ],
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3."
    },
    {
      "lang": "es",
      "value": "Un atacante puede leer cualquier archivo en el servidor que aloja el panel de H2O sin ninguna autenticación."
    }
  ],
  "lastModified": "2026-06-17T06:49:55.243",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:h2o:h2o:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "794A8437-AAB6-4D58-8086-6DA65B54BFD5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@huntr.dev"
}