Home » Database

AVID-2026-R1393

Description

S3 Bucket Takeover in h2oai/h2o-3 (CVE-2024-1456)

Details

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket ‘http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.

Reason for inclusion in AVID: CVE-2024-1456 describes a S3 bucket takeover vulnerability in the h2oai/h2o-3 AI framework, affecting AI model training/deployment workflows. It is a software supply chain issue within AI software stacks (data ingress/storage and related logic). The vulnerability is security-related (unauthorized access, data integrity/confidentiality impact) and the report provides explicit signals (CVSS metrics, CVE reference, external references). Therefore, it should be kept for AVID curation.

References

Affected or Relevant Artifacts

  • Developer: h2oai
  • Deployer: h2oai
  • Artifact Details:
TypeName
Systemh2oai/h2o-3

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Base Score7.1
Base Severity🔴 High
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability ImpactNONE

CWE

IDDescription
CWE-840CWE-840 Business Logic Errors

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-04-16
  • Version: 0.3.3
  • AVID Entry